Skip to content
Critical CVE-2026-103849 Vulnerability in Adobe Commerce and Magento

Critical CVE-2026-103849 Vulnerability in Adobe Commerce and Magento

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:49 UTC
  • •CVE-2026-103849 allows unauthenticated RCE on Adobe Commerce and Magento servers.
  • •The vulnerability has a CVSS score of 10.0, indicating critical severity.
  • •Adobe released a patch on October 13, 2026, but manual application is required.

A critical vulnerability (CVE-2026-103849) in Adobe Commerce and Magento allows unauthenticated remote code execution (RCE) through a template injection flaw, rated CVSS 10.0. Disclosed on October 13, 2026, the vulnerability affects several versions of Adobe Commerce and Magento, including 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 to 1.5.3. Attackers can exploit this flaw by injecting malicious directives into email templates, which are then executed on the server. Although no active exploitation has been confirmed, researchers have identified four potential attack vectors. Adobe has released a patch, but it requires manual application, and standard Composer installs may not address the vulnerability. Security experts recommend immediate patching due to the potential for rapid exploitation, similar to past incidents with related vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2022-02-15
CVE-2022-24086 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2025-09-09
CVE-2025-54236 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-07
CVE-2026-75650 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-103849 disclosed
Adobe published a security bulletin detailing the critical vulnerability affecting multiple versions of Adobe Commerce and Magento.
Sansec
2026-10-13
Patch released
Adobe released a patch for CVE-2026-103849, requiring manual application for affected systems.
Bleepingcomputer
2026-10-14
Exploitation routes identified
Researchers from Sansec reported identifying four potential attack paths for exploiting the vulnerability within 24 hours of the patch release.
Cycognito

More articles in this cluster (8)

Following this threat?

Track Adobe and CVE-2022-24086 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 3

Common questions

Which versions are affected?
Affected versions include Adobe Commerce 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 to 1.5.3.
Is there active exploitation of this vulnerability?
No active exploitation has been confirmed, but researchers warn that it could occur soon.
What should I do to protect my systems?
Immediately apply the patch released by Adobe on October 13, 2026, as standard Composer installs may not suffice.