Open-source business platforms, week 42 2026: critical updates for Adobe Commerce, Frappe and SuiteCRM

The release at a glance

During the week of 12–18 October 2026, the maintainers of Frappe/ERPNext, Adobe Commerce/Magento, SuiteCRM, Dolibarr, TYPO3 CMS and Shopware published 115 vulnerabilities: 104 with a CVE id and 11 security advisories without one. Severity is weighted towards the upper end, with 7 critical, 65 high, 40 medium and 3 unscored entries. Frappe/ERPNext account for 92 of the vulnerabilities; Adobe Commerce/Magento add 11, SuiteCRM 9, and Dolibarr, TYPO3 and Shopware one each. None of the vulnerabilities is listed in CISA KEV, and the advisory data does not state active exploitation.

What matters most

Adobe Commerce and Magento: CVE-2026-103849 is an improper neutralization in a template engine rated critical at CVSS 10.0. It is reachable over the network without credentials or user interaction and can lead to arbitrary code execution with changed scope. CVE-2026-92909 is an incorrect authorization flaw rated 9.8, also reachable pre-authentication over the network. CVE-2026-100133 and CVE-2026-91013 are stored cross-site scripting issues rated 9.3; they require user interaction and carry changed scope. Adobe's October 2026 updates cover all of these.

Frappe Framework / ERPNext: GHSA-9pp9-wgp9-3p3j is a remote code execution flaw caused by path traversal in file upload handling. It is rated 9.9 and affects Frappe Framework before 16.34.0 and 15.121.0. The advisory states no workaround is available; upgrading is required. This advisory is covered separately on this site.

SuiteCRM: GHSA-4773-c8fh-3rww is a PHP injection flaw in the Studio Dropdown Editor that allows an administrator to obtain persistent OS-level code execution as www-data. GHSA-6c7r-7g6m-29f9 is a time-based blind SQL injection in AOR_Reports ORDER BY that an authenticated user can use to exfiltrate data, including password hashes. GHSA-rxx9-4rg7-c3qp is a missing-authorization flaw in the V8 REST API that lets a low-privileged user read and modify ACLRoles, ACLActions and Administration rows. SuiteCRM 7.15.2 and 8.10.2 fix all three.

Patch in this order

Start with internet-facing storefronts and services, since none of the vulnerabilities has a CISA KEV due date applied.

1. Patch Adobe Commerce, Adobe Commerce B2B and Magento Open Source using Adobe's October 2026 releases: for example, Adobe Commerce 2.4.9-2026-oct, 2.4.8-2026-oct and 2.4.7-2026-oct; Adobe Commerce B2B 1.5.3-2026-oct and 1.5.2-2026-oct; Magento Open Source 2.4.9-2026-oct, 2.4.8-2026-oct and 2.4.7-2026-oct. CVE-2026-103849 and CVE-2026-92909 come first because they are critical, network-reachable and require no credentials or user interaction.
2. Upgrade SuiteCRM to 7.15.2 or 8.10.2. These fix the dropdown editor PHP injection and the SQL injection and API privilege-escalation advisories listed above.
3. Upgrade Frappe Framework to 16.34.0 or 15.121.0 to close GHSA-9pp9-wgp9-3p3j, then apply the remaining Frappe/ERPNext updates for the week.
4. After those, process Dolibarr, TYPO3 CMS and Shopware: each has one listed vulnerability in this release, and the maintainers' remediation should be applied as part of the next change window.

Beyond the patch

Releases like this are manageable when you catch the injection and authorisation flaws before they become incidents. Implementation & Assessment Services test these platforms for exactly those weaknesses, and Virtual CISO Services keep internet-facing storefronts and portals visible and under control. For any code execution or privilege abuse that still occurs, Managed Detection & Response can follow the trail through EDR and SIEM.