Adobe Commerce Template Injection Bug Grants Unauthenticated Remote Code Execution on Versions Through 2.4.9

Adobe Commerce and Magento Open Source contain a critical template injection vulnerability. This flaw allows remote attackers to execute arbitrary code without needing to interact with users, potentially seizing control of sessions.

What happened

The National Vulnerability Database records CVE-2026-103849 as a Critical severity issue. It stems from improper neutralisation of special elements within the template engine, classified under CWE-1336. Attackers can leverage this to run code in the context of the current user. According to the NVD description, exploitation does not require any user interaction. This means automated scanners or malicious actors can trigger the flaw remotely. The scope of the vulnerability is noted as changed, indicating the impact extends beyond the initially affected component. Successful exploitation could result in elevated access or full control over a victim’s account or session.

Why it matters

Environments running Adobe Commerce up to version 2.4.9-2026-sep are exposed. This includes specific builds for 2.4.8, 2.4.7, 2.4.6, 2.4.5, and 2.4.4 with the September 2026 suffix. Adobe Commerce B2B versions up to 1.5.3-2026-sep are also affected, covering 1.5.2, 1.4.2, 1.3.4, and 1.3.3 with the same date marker. Magento Open Source installations up to 2.4.9-2026-sep face the same risk, including 2.4.8 and 2.4.7 builds. Any instance using these versions is vulnerable to remote code execution.

Next steps

• Audit all Adobe Commerce and Magento Open Source installations to identify versions prior to the September 2026 updates.
• Verify if any systems are running the specific B2B versions listed as affected in the advisory.
• Monitor network traffic for signs of unauthorised code execution or unusual session activity.
• Prepare to apply vendor updates once available to mitigate the template injection risk.

Detection notes

Security teams should review web server logs for unusual HTTP requests targeting template-rendering endpoints. Look for anomalies in request parameters that might contain script-like syntax or unexpected special characters. Monitor for sudden spikes in outbound connections from web servers, which could indicate command-and-control communication. Check application logs for errors related to template parsing failures or unexpected process spawns. If suspicious activity is detected, isolate the affected server immediately to prevent lateral movement. Review access logs for new administrative accounts or privilege escalations that do not match normal user behaviour.

What to do and how to stay safe: Adobe Commerce

• Inventory all web applications to confirm if any run affected versions of Adobe Commerce or Magento Open Source.
• Implement strict input validation on all user-facing forms to mitigate template injection risks until a patch is released.
• Enable enhanced logging on web application firewalls to capture detailed request payloads for forensic analysis.
• Review current access controls to ensure compromised sessions cannot be used to escalate privileges further.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Adobe Commerce are affected by CVE-2026-103849?

Versions up to 2.4.9-2026-sep, including 2.4.8, 2.4.7, 2.4.6, 2.4.5, and 2.4.4 with the September 2026 suffix, are affected.

Does exploiting this vulnerability require user interaction?

No, the National Vulnerability Database states that exploitation of this issue does not require user interaction.

What is the CVSS score for this vulnerability?

The NVD rates CVE-2026-103849 with a CVSS score of 10, classifying it as Critical.