CVE-2026-103849

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

No known exploitation. EPSS puts it in the 57th percentile. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile57th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix3 products8 fixed builds listed below

Published 2026-10-13Updated 2026-10-20Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Adobe CommerceAffected: ≤ 2.4.9-2026-sepUpgrade to: after 2.4.9-2026-sepAffected: ≤ 2.4.8-2026-sepUpgrade to: after 2.4.8-2026-sepAffected: ≤ 2.4.7-2026-sepUpgrade to: after 2.4.7-2026-sepAffected: ≤ 2.4.6-2026-sepUpgrade to: after 2.4.6-2026-sepFixed builds2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct + 2 more branchesStated by: CVE record
Adobe Commerce B2BAffected: ≤ 1.5.3-2026-sepUpgrade to: after 1.5.3-2026-sepAffected: ≤ 1.5.2-2026-sepUpgrade to: after 1.5.2-2026-sepAffected: ≤ 1.4.2-2026-sepUpgrade to: after 1.4.2-2026-sepAffected: ≤ 1.3.4-2026-sepUpgrade to: after 1.3.4-2026-sepFixed builds1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct + 1 more branchStated by: CVE record
Adobe Magento Open SourceAffected: ≤ 2.4.9-2026-sepUpgrade to: after 2.4.9-2026-sepAffected: ≤ 2.4.8-2026-sepUpgrade to: after 2.4.8-2026-sepAffected: ≤ 2.4.7-2026-sepUpgrade to: after 2.4.7-2026-sepFixed builds2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-octStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of Adobe Commerce, Adobe Commerce B2B, or Magento Open Source your store is running.
If you're on Adobe Commerce, upgrade to 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, or 2.4.4-2026-oct depending on your branch.
If you're on Adobe Commerce B2B, upgrade to 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, or 1.3.3-2026-oct.
If you're on Magento Open Source, upgrade to 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, or 2.4.7-2026-oct.
If you can't upgrade immediately, ask your hosting provider or agency to apply Adobe's security patch and restrict admin/backend access until it's done.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

In plain language

Written by AI from the record

This is a critical flaw in Adobe Commerce (and Magento) that lets an attacker take over your online store without even logging in, so if you run one of these platforms you should patch it right away.

Unauthenticated remote code execution in Adobe Commerce/Magento via improper neutralization of template engine input, allowing full account/session takeover with no authentication or user interaction required.

If you're affected

Full storefront takeover
Customer data exposure
Payment data exposure
Store defacement or outage
Account/session hijacking

What is it

Think of your online store's software like a building with a hidden side door that nobody is supposed to be able to open without a key. This flaw means someone outside can push that door open from the internet and walk straight into the control room — no password needed — and run whatever commands they want, including taking over customer accounts.

Who is affected

This matters to you if you run Adobe Commerce, Adobe Commerce B2B, or Magento Open Source for your online store. There's no reachability gate here — any store running a vulnerable, internet-facing version is exposed, since the attacker doesn't need a login or any action from a customer.

How urgent is it

This flaw is as severe as it gets — full remote takeover with no login needed — and store platforms like this are a known, high-value target for criminals. No active attacks have been confirmed yet and no public exploit code exists, but given the ease of exploitation and the critical severity, you should patch before attackers reverse-engineer the fix, which is historically fast for Adobe Commerce/Magento bugs.

What to do — in detail

Confirm your exact build and branch (Adobe Commerce, Adobe Commerce B2B, or Magento Open Source) via admin panel or composer.json. This is a scope-changed, unauthenticated RCE (CWE-1336, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) triggered through unsanitized input reaching the template engine. Target fixed versions per branch: Adobe Commerce 2.4.10-alpha1 / 2.4.9-2026-oct / 2.4.8-2026-oct / 2.4.7-2026-oct / 2.4.6-2026-oct / 2.4.5-2026-oct / 2.4.4-2026-oct; Adobe Commerce B2B 1.5.4-alpha1 / 1.5.3-2026-oct / 1.5.2-2026-oct / 1.4.2-2026-oct / 1.3.4-2026-oct / 1.3.3-2026-oct; Magento Open Source 2.4.10-alpha1 / 2.4.9-2026-oct / 2.4.8-2026-oct / 2.4.7-2026-oct. Test in staging first since template-engine patches can affect custom themes/modules that render user-controlled data. If patching must wait, put a WAF rule in front of the affected endpoints and restrict admin access by IP as a stopgap — this is not a substitute for patching. Not currently in CISA KEV and no public exploit or confirmed in-the-wild activity (per Sansec) as of this writing, but monitor vendor advisories and threat intel feeds closely given the CVSS 10.0 score and sustained press attention; prioritize patching ahead of any PoC release.

Technical context

CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), CWE-1336 (Improper Neutralization of Special Elements in a Template Engine), scope changed. Not listed in CISA KEV; no public exploit code on record; Sansec reports no observed in-the-wild exploitation. EPSS is low/flat, reflecting no current exploitation signal, but this should not be read as a low-severity bug given the trivial attack complexity and lack of required privileges or user interaction. Exploit maturity: theoretical/PoC-absent at time of writing, but historically Adobe Commerce/Magento RCEs attract rapid reverse-engineering once patches are public.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS57th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 57th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

9 events over 9 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-20Record updated
2026-10-19Record updated
2026-10-15Record updated
2026-10-14Record updatedrecord updated
2026-10-13Publishedweakness classified, record updated

Affected products

Adobecommercial · USaka adobe systems inc.

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-1336No name in the record

Sources

References in the record

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Adobe Commerce, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account