Arbitrary Code Execution Vulnerability in Adobe Commerce
CVE-2026-103849

10CRITICAL

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Adobe Commerce B2b
Magento Open Source
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-103849?

CVE-2026-103849 is a critical vulnerability found in Adobe Commerce, a widely-used e-commerce platform designed to provide businesses with the tools necessary to create and manage online stores. This vulnerability arises from the improper handling of special elements in the platform's template engine, which can lead to arbitrary code execution. Attackers exploiting this flaw can execute malicious code in the context of the current user’s session without requiring any user interaction. This could allow attackers to gain elevated access to user accounts, potentially compromising sensitive information and operational integrity.

Potential Impact of CVE-2026-103849

  1. Privilege Escalation: The vulnerability can lead to unauthorized escalation of privileges, allowing attackers to perform actions with the same rights as the compromised user. This could enable them to alter system settings and access confidential data.

  2. Data Compromise: With the ability to execute arbitrary code, attackers could potentially exfiltrate sensitive customer information, including payment details and personal data, leading to significant data breaches and loss of customer trust.

  3. System Integrity Threat: The exploit can disrupt the normal operation of Adobe Commerce instances, potentially allowing attackers to manipulate the e-commerce environment. This could lead to fraudulent transactions, defacement of online stores, and loss of critical business functionality.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep

Adobe Commerce B2B 0 <= 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep

Magento Open Source 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2026-103849-blockstrap-lab
Created by dinosn

News Articles

favicon imageBleepingComputer

Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.

3 weeks ago

References

https://www.adobe.com/trust/security/products/commerce/ap...
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.