Threat intelligence
The Vault
The exact intelligence this scanner checks your store against: named breaches, the end-of-life matrix and every detection signature. It is versioned and printed on every report, so you always know which snapshot produced your grade.
Vault version
2026.10.3
Released
2026-10-31
Known breaches we scan for
Version-inferred and always hedged. We flag exposure by branch and never assert a CVE from a version string alone. Verify your exact patch level against each advisory.
the October template-injection flaw
criticalCVE-2026-103849 APSB26-153 Adobe Commerce / Magento 2.x
If it is missing Adobe's APSB26-153 update of 13 October 2026, a template-injection flaw lets an unauthenticated attacker run code on the server (CVSS 10.0, no login and no user interaction). The same bulletin fixes ten more: four further critical (three of them reachable without a login, one only on B2B), five high and one medium. Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9 are affected, including the September 2026 releases. Adobe knew of no exploitation when it published, but the last template injection in Magento, StyleSmuggler, was in use within days. Verify the exact patch level.
StyleSmuggler
actively exploited criticalCVE-2026-75650 APSB26-146 Adobe Commerce / Magento 2.x
If it is missing Adobe's APSB26-146 hotfix (VULN-39341), an unauthenticated attacker can inject PHP through the email template engine and run code on the server (CVSS 10.0, no login and no user interaction). Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9 are affected, including the August 2026 releases. It has been exploited in the wild since at least 4 September 2026 and is on CISA's Known Exploited Vulnerabilities catalogue. Verify the exact patch level today.
the August authorisation flaw
actively exploited criticalCVE-2026-71362 APSB26-92 Adobe Commerce / Magento 2.x
If it is missing Adobe's APSB26-92 update, an incorrect-authorisation flaw lets an unauthenticated attacker escalate privileges and reach resources they should not (CVSS 9.1, no login and no user interaction). Adobe Commerce up to 2.4.4, Magento Open Source up to 2.4.6 and Adobe Commerce B2B up to 1.3.3 are named in the advisory. Adobe published the fix on 11 August 2026, exploitation attempts began within days, and CISA added it to the Known Exploited Vulnerabilities catalogue on 24 September. Verify the exact patch level.
PolyShell
actively exploited criticalCVE-2026-48356 APSB26-73 Adobe Commerce / Magento 2.x
If it is missing Adobe's APSB26-73 update of 14 July 2026, the guest-cart REST routes accept a file upload through a product's custom options with no login, checked only by an image-header test that a polyglot file passes, and write it under pub/media/custom_options/quote/. Whether the file then runs as PHP depends on the web server configuration. Adobe scores it 9.3 and lists Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9 and B2B 1.3.3 to 1.5.3 as affected. Sansec reported mass exploitation from March 2026, before the fix reached 2.4.8 and older, and CISA added it to the Known Exploited Vulnerabilities catalogue on 27 October. Verify the exact patch level, and look for planted files even if the patch is in place.
SessionReaper
actively exploited criticalCVE-2025-54236 APSB25-88 Adobe Commerce / Magento 2.x
If it is 2.4.8-p2 or earlier without the APSB25-88 emergency hotfix (VULN-32437), an unauthenticated improper-input-validation flaw in the Commerce REST API allows customer-session takeover and, under certain configurations, remote code execution. This is actively exploited in the wild. Verify the exact patch level urgently.
CosmicSting
actively exploited criticalCVE-2024-34102 APSB24-40 Adobe Commerce / Magento 2.x
If it is 2.4.7 or earlier without the isolated CVE-2024-34102 patch, an unauthenticated XXE chains to remote code execution and encryption-key theft. Verify the exact patch level.
TrojanOrder
actively exploited criticalCVE-2022-24086 APSB22-12 Adobe Commerce / Magento 2.x
If it is 2.4.3-p1 or earlier without the APSB22-12 patch, an unauthenticated template-injection leads to remote code execution. Verify the exact patch level.
Magento 1 SUPEE gap
criticalSUPEE SUPEE Magento 1.x
Magento 1 is end-of-life and only protected by cumulative SUPEE (or OpenMage LTS) patches; unpatched instances are actively exploited. Verify the applied SUPEE level.
Adobe release lifecycle
Adobe supports each minor release separately, not the 2.4 line as a whole. Find the exact release you are on. A release past its end date receives no patches for new CVEs, however current the line looks.
| Release | Status | Released | Support ends | Extended support |
|---|---|---|---|---|
| 2.4.9 | supported | 2026-05-12 | 2029-05-31 | n/a |
| 2.4.8 | supported | 2025-04-08 | 2028-05-31 | n/a |
| 2.4.7 | supported | 2024-04-09 | 2027-05-31 | 2028-05-31 |
| 2.4.6 | extended support | 2023-03-14 | 2026-08-11 | 2027-08-31 |
| 2.4.5 | no longer patched | 2022-08-09 | 2025-08-12 | 2026-08-11 |
| 2.4.4 | no longer patched | 2022-04-12 | 2025-04-12 | 2026-04-14 |
| 2.4.3 | no longer patched | 2021-08-10 | 2022-11-28 | n/a |
| 2.4.2 | unverified | 2021-02-09 | not published | n/a |
| 2.4.1 | unverified | 2020-10-15 | not published | n/a |
| 2.4.0 | unverified | 2020-07-28 | not published | n/a |
Transcribed from Adobe's published release table on 2026-09-23 (source). Where that page states a release date but no end-of-support date we mark the row unverified and print nothing. We do not derive a date from the support policy and present it as fact.
Older lines
| Line | Status | Notes |
|---|---|---|
| 2.4 | current line | The 2.4 line is current, but support runs per MINOR release rather than per line. Several 2.4.x releases are already out of support. Check the exact release you are on in the table above. |
| 2.x | current line | A Magento 2 store of an unknown minor release. Support runs per minor release, so this tells you nothing on its own. Confirm your exact version. |
| 2.3 | end of life | The 2.3 line reached end of support; it no longer receives security patches. (EOL 2022-09-08) |
| 2.2 | end of life | The 2.2 line is long past end of support. (EOL 2019-12-31) |
| 2.1 | end of life | The 2.1 line is long past end of support. (EOL 2018-06-30) |
| 2.0 | end of life | The 2.0 line is long past end of support. (EOL 2018-03-31) |
| 1.9 | end of life | Magento 1.x is end of life; only community LTS (OpenMage) provides patches. (EOL 2020-06-30) |
Detection coverage: 59 checks
Every check the engine runs on a store, grouped by surface. Signature internals are intentionally not published.
Version & CVEs
- Magento version disclosure
- Template injection (CVE-2026-103849)
- StyleSmuggler (CVE-2026-75650)
- Privilege escalation (CVE-2026-71362)
- PolyShell file upload (CVE-2026-48356)
- SessionReaper (CVE-2025-54236)
- CosmicSting (CVE-2024-34102)
- TrojanOrder (CVE-2022-24086)
- Supported release / end-of-life
- PHP version against the October 2026 fix (CVE-2026-109618, CVE-2026-109619)
- Distribution (Magento / Adobe Commerce / Mage-OS)
Exposed files
- app/etc/env.php
- app/etc/local.xml (Magento 1)
- .env file
- .git repository
- .svn metadata
- composer.lock
- composer.lock SBOM (exact versions + modules)
- app/etc/config.php
- Setup / upgrade application
- Legacy downloader
- phpinfo() page
- var/log exposure
- RELEASE_NOTES.txt
- pub/errors config
- Media directory listing
Malware & skimmers
- Known malware signatures (Visbot / Gurulnc)
- Known-bad script domains
- Obfuscated JavaScript
- Leaked keys in JavaScript
Data exposure
- Public order RSS feed
- Public stock RSS feed
- REST API schema disclosure
- SOAP WSDL disclosure
- GraphQL introspection
- robots.txt / sitemap disclosure
Transport & headers
- Content-Security-Policy
- Strict-Transport-Security (HSTS)
- Clickjacking (X-Frame-Options)
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Subresource Integrity on third-party scripts
- Cookie Secure flag
- Cookie HttpOnly flag
- Cookie SameSite
- TLS certificate & protocol
- Server software disclosure
Access surface
- Default admin path
- Exposed admin tools (Magmi, Adminer)
- Frontend stack detection
Supply chain
- JavaScript library versions
- Third-party script inventory (PCI 6.4.3)
- Installed third-party extensions
- Extensions with a published advisory
- Vulnerability disclosure contact (security.txt)
Email & exposure
- SPF record
- DMARC (spoofing / deliverability)
- Subdomain exposure (Certificate Transparency)
Supply chain we track
Two datasets, both keyed on something a storefront publishes about itself: the version a bundled library declares in its own banner, and the module name Magento puts in an asset URL. Neither carries a patch level, so every match is marked inferred and phrased as something to check.
JavaScript libraries
6 libraries Magento bundles, and the advisories published against each.
- jQuery CVE-2020-11023, CVE-2020-11022, CVE-2019-11358
- jQuery UI CVE-2022-31160, CVE-2021-41182
- RequireJS CVE-2024-38999
- Knockout CVE-2019-14862
- Underscore CVE-2021-23358
- Moment.js CVE-2022-31129
Extensions with a published advisory
Deliberately short. An entry ships only when the advisory, the affected range and the module name can each be cited, and only when the module puts that name in a storefront asset path. A store is matched on that name, so it is read from the extension's own repository or the entry does not exist.
- Cardgate_Payment: below 2.0.33, fixed in 2.0.33 CVE-2020-8818
- Klaviyo_Reclaim: 1.0.0 up to but not including 3.0.0, fixed in 3.0.0 GHSA-hvgw-gg3p-295j
- Algolia_AlgoliaSearch: below 3.16.2, fixed in 3.16.2 GHSA-595p-g7xc-c333
- Algolia_AlgoliaSearch: 3.17.0-beta.1 up to but not including 3.17.2, fixed in 3.17.2 GHSA-595p-g7xc-c333
- Fastly_Cdn: below 1.2.26, fixed in 1.2.26 CVE-2017-13761
- Mageplaza_Blog: 4.3.2 and below, no fixed release CVE-2026-79322
- Cart2Quote_Quotation: 4.1.6 up to but not including 4.4.6, fixed in 4.4.6 GHSA-pgj4-g5j4-cmfx
- Cart2Quote_Quotation: 5.0.0 up to but not including 5.4.4, fixed in 5.4.4 GHSA-pgj4-g5j4-cmfx
How the vault stays current
The advisory index
The advisory index (every tracked CVE and its actively exploited flag) is pulled from two authoritative feeds: NVD for the CVE records and CISA KEV for real-world exploitation. It is refreshed and reviewed before a release, then ships with it, so the date below is the age of the index this scanner is actually running on and not the last time a job was due. Last refreshed 2026-11-01T21:23:35Z. Every release is integrity-checked before it goes out. Each signature must compile and each CVE must carry working remediation.
Sources
- NVD: the National Vulnerability Database (CVE records, CVSS)
- CISA KEV: Known Exploited Vulnerabilities (real-world exploitation)
- Adobe Commerce PSIRT security advisories (APSB26-153, APSB26-146, APSB26-92, APSB26-73, APSB25-88, APSB24-40, APSB22-12)
- Adobe Commerce released-versions table (lifecycle dates, retrieved 2026-09-23)
- Sansec threat research (sansec.io/research)
- gwillem/magento-version-identification
- NVD (National Vulnerability Database)
- CISA Known Exploited Vulnerabilities catalogue
- FIRST EPSS (exploit prediction scoring)
- OSV.dev: GitHub Advisory Database (npm and Packagist ecosystems)
- RFC 9116: a file format for security contact information
- magento/magento2 release tags (bundled library versions, read per tag)
- gwillem/magento-version-identification (Magento 1 file checksums)
- Packagist package metadata (composer type, published versions)
- FriendsOfPHP/security-advisories (PHP package advisory database)
- PHP security advisory, 21 October 2026 (php.net), with the php-src GitHub security advisories it links
Live, per scan
What runs in real time is the scan itself. Against your store, the engine issues only passive GET/HEAD requests under a user-agent that names us, and inspects the live TLS handshake.
- Passive & read-only. Nothing is written to your store
- If your WAF or CDN turns us away, we stop and mark the report incomplete. We do not disguise the scanner to get past it
- The intelligence ships with the engine. A scan needs no external call
- Every report prints the vault version that produced it