What is CVE-2026-103849?
CVE-2026-103849 is a template injection vulnerability in Adobe Commerce, classified as CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine. Special elements passed into the template engine are not neutralised, and the result is arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 10.0, the maximum the scale allows, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Attack vector is network, attack complexity is low, no privileges are required, and no user interaction is required. Confidentiality, integrity, and availability impacts are all rated high, and scope is changed.
A 10.0 is rare because every factor has to break the wrong way at once, and here they do. There is no account to obtain, no victim to phish, no configuration precondition to satisfy, and the consequences reach beyond the component that holds the flaw. Adobe’s own description is that exploitation could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session, and that exploitation does not require user interaction.
The target class raises the stakes further. These are online stores. A compromised storefront is not only a compromised server, it is a payment page, a customer database, and a checkout flow under someone else’s control. Payment-skimming groups have run industrial-scale campaigns against this exact platform for years, which means the path from public advisory to monetised access is already paved.
Magento’s template handling has been the exploited surface before. CVE-2022-24086 was mass-exploited against Magento and Adobe Commerce stores in the TrojanOrders campaign, with attackers moving at scale within days of disclosure. No exploitation of CVE-2026-103849 has been reported at publication, and Adobe credits external discovery rather than in-the-wild observation, but the operational history of this platform argues for treating the patch window as very short.
What assets are affected by CVE-2026-103849?
Three products are in scope: Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
The version scheme deserves attention because it is easy to misread. Adobe now ships dated patch releases, so the affected builds are written as 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, and so on down the supported lines, with Adobe Commerce reaching back to 2.4.4-2026-sep and Magento Open Source covering 2.4.7 and later. Adobe Commerce B2B follows the same pattern across 1.5.3, 1.5.2, 1.4.2, 1.3.4, and 1.3.3.
The practical consequence is that the familiar answer to the patch question is now meaningless. Knowing a store runs 2.4.7 says nothing at all about whether it is affected, because 2.4.7-2026-sep is vulnerable and 2.4.7-2026-oct is not. The dated suffix carries the entire signal, and any inventory that records only the major line cannot answer the question.
In practice an affected asset is a public e-commerce storefront. These are built to be reachable by anyone with a browser, so there is no question of accidental exposure or of a service that should have been behind a firewall. Every affected store is reachable by definition, and the only variable is whether it has taken the October release.
Externally, the dated patch level is not visible. A scan identifies the platform. It cannot identify the build.
What does our data show about exposure patterns?
Exposure in this set is led by Communication Services at 42.96% of observed assets, with Industrials at 18.89% and Consumer Discretionary at 18.41%. The remaining sectors together account for 19.74%.
That distribution is less surprising than it looks once you account for how storefronts multiply. A single media or consumer group can run a separate Commerce instance per brand, per market, and per language, so one organization generates a large number of distinct assets. The sector shares therefore track the brand portfolios of the largest groups in the set as much as they track platform adoption.
Concentration supports that reading. The largest single estate accounts for a bit under a quarter of the observed assets on its own, and the distribution falls away into a long tail of much smaller estates. Sector ordering under that shape should be read as a statement about who operates many storefronts, not about which industries are most at risk.
The composition of these assets is unlike the infrastructure exposures we usually report. Almost every observed asset is a named web application rather than a bare address, which is exactly what a storefront estate looks like from outside. There is no inventory discovery problem here in the usual sense. The hostnames are public, indexed, and advertised.
Version evidence is thin and, given Adobe’s dated release scheme, thinner than the raw figure suggests. Only around one in seven of the observed assets carries any version indicator at all, and nearly all of those record only the major line rather than a patch level. A major-line match tells a defender nothing about whether the October release has been applied, so external data cannot separate a patched store from an unpatched one.
One pattern in the hostnames is worth acting on directly. Roughly one in six of the observed storefronts carries a staging, test, QA, or demo marker, and a recurring prefix among them is the default naming convention Adobe Commerce Cloud uses for staging environments. These environments are internet-facing as provisioned, they typically run the same codebase as production, and they usually sit outside the change window that governs the production store. For an unauthenticated remote code execution flaw, a staging instance is not a lesser target. It is the same application with less attention on it.
The geographic field needs a caveat rather than an interpretation. The overwhelming majority of these assets resolve to the United States, which does not match the European composition of the estates themselves. For storefronts served through content delivery networks and cloud hosting, the recorded location reflects where the edge or origin sits rather than where the business operates. The map is a picture of hosting, not of market presence, and should not be read as the latter.
Are fixes available?
Yes. Adobe published the fix in security bulletin APSB26-153 on 13 October 2026. The remediation is the October dated release on whichever line a store is running: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, or 2.4.4-2026-oct for Adobe Commerce, the matching October builds for Magento Open Source on 2.4.7 and later, and 1.5.3-2026-oct through 1.3.3-2026-oct for Adobe Commerce B2B. The 2.4.10-alpha1 and 1.5.4-alpha1 builds are also unaffected.
Adobe has published no workaround in the CVE record. For a pre-authentication flaw in the template engine of a public storefront, there is no configuration change that meaningfully substitutes for the patch.
Two things make this patch easier to get wrong than usual. The first is the dated versioning, where applying “the latest 2.4.7” from a stale internal mirror can leave a store on the September build and looking current. The second is estate coverage, since organizations running many brand storefronts need every instance on the October release, and staging environments count.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory every Adobe Commerce, Adobe Commerce B2B, and Magento Open Source instance, recording the full dated build rather than the major line
- Include staging, QA, demo, and brand-specific storefronts in that inventory, not only the primary production store
- Apply the October 2026 dated release on every affected line, per bulletin APSB26-153
- Review whether internet-facing staging environments need to stay publicly reachable at all
- Check checkout and payment pages for unauthorised script injection, the standard monetisation path on this platform
- Review admin accounts, API keys, and integration tokens for unexpected additions or changes
- Watch application logs for anomalous template rendering errors and unexpected process execution
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-103849 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
