Adobe · Code execution
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context o…
At a glance
~0.8% estimated chance of attack in 30 days. Exploitation not confirmed.
Medium rather than High: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Leaders should confirm whether Adobe Commerce systems are in their estate and assess potential risks from this vulnerability.
Questions to ask IT
- Do we run Adobe Commerce and Magento, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 9 Nov?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-103849- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Not listed
- ~0.8% estimated chance of attack in 30 days
- Not linked from the CVE record
- CVE-2026-103849 involves improper neutralisation of special elements used in a template engine.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- Adobe Commerce is affected by a vulnerability that could allow arbitrary code execution in the context of store servers.
- Researchers report that hackers could exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce.
Read the original reportBleepingComputer(opens in a new tab)
Products and services involved
- Adobe Commerce98% match confidence · CVE-2026-103849
- Magento93% match confidence · CVE-2026-103849
Part of Multiple Chrome and Adobe vulnerabilities disclosed
- UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page
- Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information…
- Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted…
- Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Pulse
Last checked 6d ago · Recheck overdue since 3 Nov 2026, 08:09 UK time
held at 0.8%; ranking metadata was updated.
Sources
- BleepingComputerNews
Critical BlockStrap flaw lets hackers run code on Magento servers
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context o…
- ProbableSummary fact75% confidence
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-103849
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-103849 has an estimated ~0.8% chance of attack in 30 days (55th percentile) as of 2026-10-16 — probability signal, not confirmed exploitation