I am currently installing 10266 on multiple sites, and when running the patch via cli:
Checking if patch can be applied/reverted successfully... Patch was applied/reverted successfully.
Perfect. However when I run the sites through magereport.com, 10266 is shown as "not patched", even after providing the backend url. Is this a case of magereport requiring certain permissions to function? If so, which ones?
And yes, I flushed the cache :)