Adobe Commerce and Magento Open Source share a long product history. An internet search for the current Adobe Commerce application label may miss sites that still use Magento in a title, template, or administrative page. APSB26-153 provides a useful setting for that measurement problem.

The bulletin fixes CVE-2026-103849, a critical unauthenticated template injection issue with a CVSS 3.1 score of 10.0, plus other critical authorization and cross-site scripting issues in Commerce and B2B.

At 2026-11-14 07:48 Asia/Shanghai, with sub_type=all, page 1, and page size 1, ZoomEye returned:

  • app="Adobe Commerce": 0 matches.

  • title="Magento": 5,377 matches for Magento.

The zero application count does not show that Adobe Commerce is absent. It shows that this exact application label did not match public assets in the selected index scope. The title query reflects a different naming convention and a broader page field.

Why Magento titles persist

Magento remains a recognizable brand in commerce documentation, extensions, themes, hosting pages, and administrative interfaces. A page title can contain Magento even when the underlying product is Adobe Commerce or a historical installation.

The result is suitable for discovery and brand monitoring. It is not a count of vulnerable versions. A site could be on a supported October 2026 patch, a previous isolated patch, or an unsupported build.

The patch decision

Adobe lists affected Commerce and Magento Open Source release lines at the September 2026 patch level or earlier. The October 2026 isolated patches are the fixed versions for the listed lines. The separate CVE-2026-75650 hotfix must also be applied.

The distinction matters because a title match cannot reveal whether the patch was installed. The owner must check the product edition, release line, patch level, B2B package, and hotfix state.

Hardening after the patch

Review custom themes, CMS blocks, email templates, page-builder content, and extensions. Limit who can edit template-bearing content. Separate content editors from users who can deploy code or change integration credentials.

Check the Commerce logs for template-like input in unexpected parameters, new administrator accounts, extension changes, and outbound connections from the web tier. Preserve the application logs before clearing caches if an incident is suspected.

Reporting the evidence

The correct statement is that ZoomEye's app="Adobe Commerce" query returned zero matches while the broader title="Magento" query returned 5,377. Neither result establishes a vulnerable count. The first is a narrow label result, and the second is a broad naming and web-title result.

Conclusion

Band names change more slowly than product packaging. A Magento title search can help find commerce sites for ownership review, but Adobe Commerce patching requires edition and build evidence. The 0 and 5,377 counts should remain separate facts.

References