Open-source business platforms, week 42 2026: 115 vulnerabilities across ERPNext, Adobe Commerce and SuiteCRM

The release at a glance

The maintainers of Frappe / ERPNext, Adobe Commerce / Magento, SuiteCRM, Dolibarr, TYPO3 and Shopware published 115 vulnerabilities during the week 12 October to 18 October 2026. Of these, 104 have CVE ids and 11 are security advisories without CVE identifiers. Severity is 7 critical, 65 high, 40 medium and 3 unscored. None of the entries appears in CISA's Known Exploited Vulnerabilities catalogue, and no entry is marked as exploited in the source advisories.

Frappe / ERPNext accounts for 92 vulnerabilities, Adobe Commerce / Magento for 11, SuiteCRM for 9, and Dolibarr, TYPO3 and Shopware for one each. The issues that should shape patching priority are concentrated in Adobe Commerce, Frappe Framework and SuiteCRM.

What matters most

Frappe Framework. GHSA-9pp9-wgp9-3p3j is a critical path traversal in file-upload handling. An authenticated user can write a file outside the intended storage directory and achieve remote code execution. No workaround is available; upgrading is required. Fixed versions are Frappe Framework 16.34.0 and 15.121.0.

Adobe Commerce / Magento. CVE-2026-103849 has a CVSS score of 10.0 and describes improper neutralisation of special elements in a template engine. It can allow arbitrary code execution without user interaction. CVE-2026-92909, at 9.8, is an incorrect authorization flaw that can also lead to arbitrary code execution without user interaction. CVE-2026-100133 and CVE-2026-91013 are stored cross-site scripting flaws, both scored 9.3. The October 2026 releases fix these issues.

SuiteCRM. GHSA-4773-c8fh-3rww is a critical OS-level code injection in the Studio Dropdown Editor. An administrator can achieve persistent code execution as www-data. GHSA-6c7r-7g6m-29f9 is a time-based blind SQL injection through the AOR_Reports ORDER BY clause, scored 8.8. GHSA-rxx9-4rg7-c3qp is a privilege escalation flaw that lets any authenticated user modify ACL roles and Administration configuration. All are fixed in SuiteCRM 8.10.2 and 7.15.2.

Patch in this order

1. Patch Adobe Commerce and Magento Open Source first. CVE-2026-103849 and CVE-2026-92909 are reachable over the network without user interaction and can lead to arbitrary code execution. Apply the October 2026 releases: Adobe Commerce 2.4.4-2026-oct, 2.4.5-2026-oct, 2.4.6-2026-oct, 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct or 2.4.10-alpha1; Adobe Commerce B2B 1.3.3-2026-oct, 1.3.4-2026-oct, 1.4.2-2026-oct, 1.5.2-2026-oct, 1.5.3-2026-oct or 1.5.4-alpha1; Magento Open Source 2.4.7-2026-oct, 2.4.8-2026-oct, 2.4.9-2026-oct or 2.4.10-alpha1.

1. Patch Frappe Framework next. GHSA-9pp9-wgp9-3p3j has no workaround; upgrade to 16.34.0 or 15.121.0.

1. Patch SuiteCRM. Upgrade to 8.10.2 or 7.15.2 to resolve the OS-level code injection, SQL injection and privilege escalation flaws.

1. Then apply the remaining high-severity updates across ERPNext and the other products, prioritising any internet-facing instances. No CISA KEV due date applies to this batch.

Beyond the patch

Updates like this become more manageable when the underlying injection and access-control flaws are found before an attacker does. Our Implementation & Assessment Services include penetration testing and hardening that target injection, deserialisation and authentication weaknesses of the kind released here. For organisations that want operational oversight while patches are scheduled, Managed Detection & Response watches for the code execution, privilege escalation and credential abuse a compromise of these flaws would leave behind.