Magento and Adobe Commerce APSB26-73 Security Update & Patch Guide

You can now use the AI coding developer tooling to create new App Builder applications and convert existing Adobe Commerce PHP extensions to App Builder applications. A new view_all_company_orders company role enables B2B company customers to view all orders within their company, including historical orders created by Admin users. A new numeric product attribute input type allows merchants to create decimal attributes that support negative values. If you have Payment Services enabled, the Dashboard UI is now available in the Commerce Admin, providing access to the Transactions report for viewing and managing payment transactions.

• This migration ensures Adobe Commerce remains compliant with open-source licensing, avoids known TinyMCE 6 vulnerabilities, and delivers a modern, supported editing experience for merchants and developers.
• Fixed issue where configurable products displayed the price with an incorrect “As low as” label on PDP/PLP.Now, the product shows the correct price ($500) without any misleading labels.
• Now, Payment Services updates the Admin configuration with PayPal Merchant ID and PayPal Merchant Status values.
• If successfully exploited, these vulnerabilities could result in privilege escalation, arbitrary code execution, security feature bypass, unauthorized access to application functionality, or limited disclosure of sensitive information.

Fixed issue where required fields on the customer account creation page showed no validation messages when left empty.Now, proper error messages are displayed for all empty or incorrect fields. Fixed issue where wishlist comments were not updated through GraphQL mutations.Now, comments update correctly and reflect in both the API response and storefront. Previously, changing the store header language while retrieving a product from the cart via GraphQL did not reflect the updated language, resulting in inconsistent localization. Fixed pagination issue in inventory export stock salable quantity API where total_count was incorrectly limited to page size.
Previously, even though the access token is still valid, Adobe Commerce always make new requests to FedEx API which caused a rate limiting issue. Adobe Commerce is no long make many requests to FedEx API service for the access token. Order State assignment now works as expected.Previously, when assigning custom order statuses, the “Processing” state could disappear from the dropdown after unassigning a status, making it impossible to reassign.AC-15010 The update ensures the link now contains a valid, crawlable URL, improving site discoverability and helping pass Google SEO audits. Resolved an SEO issue where the storefront “Compare Products” link was not crawlable by search engines due to a missing or improperly bound href attribute.

Manage custom email templates through the API

It is recommended to upgrade and test before pushing to production. The Product Listing widget has been updated to use the Catalog Service API. Category Preview only shows the selected category.

clearCart GraphQL mutation is now available in Magento Open Source

The system now sorts The newest products in the database (the one with the highest entity_id) are shown first Fixed an issue where the special price https://best-adobe-commerce-cloud-agencies.com/ for a configurable product’s child (simple) product was not displayed correctly on the product listing page when “Used in Product Listing” was set to No. Now, the selected options are retained, allowing the product to be added to the cart smoothly without prompting users to reselect options. When a graphQL request for an item with insufficient quantity was made, a proper error message with an error code was returned, and if the requested quantity is available, the cart update was successful. GraphQL calls to place an order for a nonexistent or inactive cart now correctly return CART_NOT_ACTIVE or CART_NOT_FOUND error codes in all store views, fixing an issue where translated error messages previously resulted in an UNDEFINED code. Resolved an issue that caused a null quote to be created during the “Login as Customer” flow.

46 yr old Web Designer III Valery Terbeck, hailing from Guelph enjoys watching movies like Outsiders (Ceddo) and Rock climbing. Took a trip to Historic Centre of Guimarães and drives a Jaguar D-Type.