Advisory · CVE-2026-103849
Template engine injection in Adobe Commerce gives unauthenticated code execution
Adobe Commerce does not safely neutralize special elements used by its template engine, and an unauthenticated attacker can turn that into arbitrary code execution with changed scope. Adobe rates it CVSS 3.1 10.0.
- Vendor
- Adobe
- Product
- Adobe Commerce
- Identifier / CWE
- CVE-2026-103849
CWE-1336 - Action timing
- Immediate
Explain it like I’m five
The store's template machinery treats attacker input as instructions instead of text, so a stranger can make the server run code it was never supposed to see.
- 01Send crafted input
An unauthenticated attacker submits input containing template-engine directives.
- 02Engine evaluates it
Commerce passes the input into template rendering without neutralizing the special elements.
- 03Code executes
The attacker's directives run on the server in the application's context.
What happened
Adobe disclosed CVE-2026-103849 in bulletin APSB26-153. The flaw is improper neutralization of special elements used in a template engine (CWE-1336) in Adobe Commerce, Commerce B2B, and Magento Open Source, reachable without authentication or user interaction, and Adobe scores it 10.0.
Adobe’s affected data covers Commerce and Magento Open Source release lines through the September 2026 updates, with the October 2026 updates listed as unaffected. Apply the APSB26-153 update for your release line.
What to do
- Inventory every Adobe Commerce deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Commerce while remediation is underway, especially for internet-facing instances.
- Review application and server logs for template rendering errors, requests containing template syntax, and new files or admin users appearing outside deployments.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
A perfect-score, unauthenticated code execution flaw in a storefront platform is patch-today material. Apply APSB26-153 and hunt for web shells and rogue admin accounts.