2018-09-10: Magento 2.2.6 and 2.1.15 Security update

unknown Affects magento/product-community-edition. Feed 2026.10.29.1, updated 2026-10-28.

Magento 2.2.6 and 2.1.15 Security update

Package: magento/product-community-edition Composer
Affected versions: >=2.1 and <2.1.15 or >=2.2 and <2.2.6
Fixed in: 2.1.15, 2.2.6
Severity: unknown
Exploitation: not on CISA KEV
Source: friendsofphp

References

https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update

NVD record magento/product-community-edition advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2024-34102 KEV critical Magento Open Source affected by an Improper Restriction of XML External Entity Reference ( same package: magento/product-community-edition
CVE-2019-7139 critical Magento 2 Community Edition SQLi Vulnerability same package: magento/product-community-edition
CVE-2019-7850 unknown PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature same package: magento/product-community-edition
CVE-2019-8159 high Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition
CVE-2019-7846 unknown PRODSECBUG-1513: Insufficient brute force protections on promo code entry same package: magento/product-community-edition
CVE-2019-8144 critical Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition