Arbitrary Code Execution Vulnerability in Adobe Commerce
CVE-2026-103849

10CRITICAL

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Adobe Commerce B2b
Magento Open Source
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-103849?

Adobe Commerce is susceptible to a vulnerability that allows improper neutralization of special elements utilized in its template engine. This flaw could enable an attacker to execute arbitrary code within the context of the current user, potentially providing elevated access or control over the affected user’s account or session. Notably, exploitation of this vulnerability does not necessitate user interaction, making it a significant threat. It is crucial for users and administrators of Adobe Commerce to be aware of this issue and apply recommended security measures.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep

Adobe Commerce B2B 0 <= 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep

Magento Open Source 0 <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep

News Articles

favicon imageBleepingComputer

Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.

11 hours ago

References

https://www.adobe.com/trust/security/products/commerce/ap...
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.