Vulnerabilities & Exploits · Web App Attack

Adobe Commerce flaw lets attackers run PHP code

BleepingComputer reports a critical Adobe Commerce and Magento vulnerability, CVE-2026-103849, that could let attackers run arbitrary PHP code on store servers.

The bug sits in how the platform handles rendered content: attacker-controlled text can be treated like template instructions instead of data, so what should be shown to shoppers may be executed by the server. That turns a storefront into an attacker-run PHP environment, with the usual reach of the web server account into checkout flow tampering, order data, and follow-on intrusion.

For teams running Magento or Adobe Commerce, the exposure is not just one page or one module but the server behind the storefront. If the commerce app can execute code, the rest of the environment inherits whatever that account can touch.

1 source · 11h ago

CVE-2026-103849

NVD KEV

Published Oct 13 by Adobe Systems Incorporated

CVSS 10 CRITICAL: adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…

Timeline

Sources

Part of the PlainSec briefing for 2026-10-17

Every edition of this story: Adobe Commerce flaw lets attackers run PHP code

More from today