Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If your store runs on Magento or Adobe Commerce, someone could run code on the server without logging in. That's how card skimmers get onto checkout pages. Adobe's October update fixes it. Install it, and keep September's hotfix in place too. https://hol.org/blog/cve-2026-103849-adobe-commerce-magento-unauth-rce https://t.co/6iae0jGBGP
Magento October patch is out. CVE-2026-103849 is CVSS 10.0 with no auth, same bug class as September's exploited one. Open Source 2.4.6 gets no fix. Adobe says 30 days, I'd do it this week. https://privatedevops.com/news/magento-october-2026-security-update https://t.co/Gnm5CftPCJ
#NØØT_Security_Alerts 🚨 #ALERT — ADOBE COMMERCE CVSS 10.0: CRITICAL UNAUTHENTICATED REMOTE CODE EXECUTION October 13, 2026 DISCLOSED BY: Adobe Security PRODUCT: Adobe Commerce / Magento Open Source CVE: CVE-2026-103849 SEVERITY: CRITICAL — CVSS 3.1: 10.0 WEAKNESS: CWE-1336 — Template Injection AFFECTED VERSIONS: Adobe Commerce 2.4.4–2.4.9 branches through their September 2026 security releases. Magento Open Source 2.4.6–2.4.9 branches through their September 2026 security releases. IMPACT: Improper handling of special elements in a template engine could allow arbitrary code execution on vulnerable commerce installations. EXPOSURE: Network-accessible vulnerable deployments. Adobe confirms exploitation requires no authentication or user interaction. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. Adobe reports no known in-the-wild exploitation. No independently verified working public PoC has been established. The maximum CVSS score describes potential severity, not evidence of successful compromise. Forensic triage: Review unexpected template modifications, suspicious application requests, unauthorized filesystem changes and unexplained processes launched by web application services. Preserve relevant application, web-server and authentication logs. These are precautionary investigation steps, not confirmed exploit signatures. No CVE-specific malicious IOCs have been published. URGENT ACTION: Apply Adobe’s October 2026 security releases immediately. Update affected Commerce and Magento installations to their corresponding 2026-oct patched versions. Verify that previously required security hotfixes remain installed. Restrict unnecessary administrative exposure and investigate suspicious activity. SOURCE: https://www.adobe.com/trust/security/products/commerce/apsb26-153.html CONFIDENCE: HIGH — Adobe’s October 13 security bulletin directly confirms unauthenticated code execution, affected release branches and remediation availability. Active malicious exploitation remains unverified. #CyberSecurity #ThreatIntel #AdobeCommerce #Magento #RCE #WebSecurity
Adobe Commerce products face two critical flaws. • CVE-2026-103849 at CVSS 10 • CVE-2026-100133 at 9.3 Multiple versions across Commerce, B2B, and Magento Open Source require attention. https://thecircuitry.to/article/pair-of-severe-flaws-surface-in-adobe-commerce-products-mv734xbz