CRITICAL CWE-1336
CVE-2026-103849
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe·Commerce
10.0/ 10
CVSS 3.1
Critical severity
1.2%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 68% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list, but a public proof of concept exists.
Timeline
- Published
- Oct 13, 2026
- Updated
- Oct 20, 2026
- First covered
- Oct 18, 2026
- Latest story
- 4 weeks ago
Summary
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
- Adobe Commerceup to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
- Adobe Commerce B2Bup to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
- Adobe Magento Open Sourceup to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep