Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
5924 articles · 249450 vulns · 37/41 feeds (7d)
← Back to list
10.0
CVE-2026-103849PATCHED
adobe · commerce

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Affected Products

VendorProductVersions
adobecommerce0, 0, 0

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
adobemagentocert_advisory90%

References

  • https://www.adobe.com/trust/security/products/commerce/apsb26-153.html(vendor-advisory)

Related News (4 articles)

Tier D
BleepingComputer7d ago
Critical BlockStrap flaw lets hackers run code on Magento servers
→ No new info (linked only)
Tier B
BSI Advisories9d ago
[NEU] [hoch] Adobe Magento Open Source: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
CERT-FR9d ago
Multiples vulnérabilités dans les produits Adobe (14 octobre 2026)
→ No new info (linked only)
Tier C
VulDB10d ago
CVE-2026-103849 | Adobe Commerce B2B/Commerce/Magento Open Source Template Engine neutralization
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.110.0 CRITICAL
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited❌ No
Patch available
2.4.10-alpha12.4.9-2026-oct2.4.8-2026-oct2.4.7-2026-oct2.4.6-2026-oct2.4.5-2026-oct2.4.4-2026-oct1.5.4-alpha11.5.3-2026-oct1.5.2-2026-oct1.4.2-2026-oct1.3.4-2026-oct1.3.3-2026-oct2.4.10-alpha12.4.9-2026-oct2.4.8-2026-oct2.4.7-2026-oct
CWECWE-1336
PublishedOct 13, 2026
Trending Score32
Source articles4
Independent4
Info Completeness0/14
Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-75650EXPKEV
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Trending: 102
CRITICALCVE-2026-106621
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Trending: 21
CRITICALCVE-2026-106622
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
Trending: 21
CRITICALCVE-2026-105899
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
Trending: 21
CRITICALCVE-2026-106624
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Trending: 21

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 13, 2026
Discovered by ZDM
Oct 13, 2026
Patch Available
Oct 20, 2026