Adobe Commerce Critical Vulnerability Allows Remote Code Execution

Adobe Commerce and Magento Open Source contain a critical security vulnerability that permits arbitrary code execution. The National Vulnerability Database lists this flaw as CVE-2026-103849. The issue stems from improper neutralization of special elements in a template engine. Attackers can exploit this weakness to gain elevated access or control over victim accounts.

The National Vulnerability Database rates CVE-2026-103849 as critical. The underlying weakness is classified as CWE-1336. This type of flaw involves failing to properly neutralize special elements used in a template engine. Successful exploitation results in arbitrary code execution within the context of the current user. The scope of the vulnerability is marked as changed.

Context and background

Exploitation of this issue does not require user interaction. This means an attacker can trigger the vulnerability remotely without needing a victim to click a link or open a file. The flaw could potentially allow an attacker to gain elevated access or control over the victim's account or session. Such access could lead to further compromise of the system or data residing on the server.

The severity rating reflects the ease of exploitation and the potential impact. The vulnerability affects the template engine processing within the software. Improper handling of special elements allows malicious input to be executed as code. This type of template injection flaw is particularly dangerous because it often bypasses standard input validation controls.

Who is affected

Multiple versions of Adobe products are affected by this vulnerability. Adobe Commerce versions up to 2.4.9-2026-sep are vulnerable. This includes versions 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, and 2.4.4-2026-sep. Adobe Commerce B2B versions up to 1.5.3-2026-sep are also affected.

The impact extends to older Adobe Commerce B2B releases. Versions 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, and 1.3.3-2026-sep contain the flaw. Adobe Magento Open Source is also affected. Versions up to 2.4.9-2026-sep, 2.4.8-2026-sep, and 2.4.7-2026-sep are vulnerable.

What should you do?

Administrators should verify their current software versions against the affected list. Organizations should monitor for signs of unauthorized code execution or account takeover. That suggests immediate inventory of deployed templates and input handling mechanisms. No confirmed fix or patch has been stated in the source material yet.