Adobe has disclosed CVE-2026-103849, a CVSS 10.0 template engine injection flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that could allow arbitrary code execution without user interaction.
What Is It
CVE-2026-103849 is an Improper Neutralization of Special Elements Used in a Template Engine vulnerability (CWE-1336) in Adobe Commerce. According to Adobe's description, successful exploitation could result in arbitrary code execution in the context of the current user. It could also give an attacker elevated access or control over the victim's account or session.
Adobe PSIRT reported the flaw, and NVD published it on 2026-10-13. The NVD record is currently in "Received" status.
Why It Matters
Adobe scored this vulnerability 10.0 (CRITICAL) under CVSS 3.1, the highest possible rating:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability Impact: High / High / High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
An attacker could exploit this remotely without credentials or user interaction, and the impact can extend beyond the vulnerable component. Commerce platforms process payments and customer data, so they are high-value targets.
The CISA Known Exploited Vulnerabilities (KEV) catalog does not list this CVE as of publication, so KEV does not currently confirm active exploitation.
What's Vulnerable
Adobe Commerce: These versions and earlier are affected: - 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
Adobe Commerce B2B: These versions and earlier are affected: - 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
Magento Open Source: These versions and earlier are affected: - 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
Patch Status
Adobe has published security bulletin APSB26-153. The vendor data lists these versions as not affected:
- Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
- Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
- Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Administrators should move to the matching 2026-oct release for their version line and check the Adobe bulletin for full upgrade guidance. Because the CVE is not listed in the CISA KEV catalog, there is no KEV required action or due date.