International Cyber Digest on X: "‼️ A CVSS 10 flaw lets attackers run code on Magento ...

Back X

International Cyber Digest on X: "‼️ A CVSS 10 flaw lets attackers run code on Magento ...

X • October 17, 2026

Share: View original

‼️ A CVSS 10 flaw lets attackers run code on Magento and Adobe Commerce servers without a login.

Sansec reproduced 4 exploit routes within a day of Adobe's Oct 13 patch.

Adobe still gave stores 30 days. Last month's sister bug was mass-exploited in 3.

Blockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-103849 Vulnerability in Adobe Commerce and Magento A critical vulnerability (CVE-2026-103849) in Adobe Commerce and Magento allows unauthenticated remote code execution (RCE) through a template injection flaw, rated CVSS 10.0. Disclosed on October 13, 2026, the vulnerability affects several versions of Adobe Commerce and Magento, including 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 to 1.5.3. Attackers can exploit this flaw by injecting malicious directives into email templates, which are then executed on the server. Although no active exploitation has been confirmed, researchers have identified four potential attack vectors. Adobe has released a patch, but it requires manual application, and standard Composer installs may not address the vulnerability. Security experts recommend immediate patching due to the potential for rapid exploitation, similar to past incidents with related vulnerabilities. 6 sources 71

Extracted Entities

CVEs (1)

CVE-2026-103849

Platforms (2)

Adobe Commerce Magento