CVE-2026-103849
Published Oct 13 by Adobe Systems Incorporated
CVSS 10 CRITICAL: adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…
Vulnerabilities · 10h ago
BleepingComputer reports a critical Adobe Commerce and Magento vulnerability, CVE-2026-103849, that could let attackers run arbitrary PHP code on store servers.
The bug sits in how the platform handles rendered content: attacker-controlled text can be treated like template instructions instead of data, so what should be shown to shoppers may be executed by the server. That turns a storefront into an attacker-run PHP environment, with the usual reach of the web server account into checkout flow tampering, order data, and follow-on intrusion.
For teams running Magento or Adobe Commerce, the exposure is not just one page or one module but the server behind the storefront. If the commerce app can execute code, the rest of the environment inherits whatever that account can touch.
Published Oct 13 by Adobe Systems Incorporated
CVSS 10 CRITICAL: adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…
1 source covering this story
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
Part of the PlainSec briefing for 2026-10-17