Adobe Commerce: Template injection leads to remote code execution

Summary

Adobe Commerce, Adobe Commerce B2B and Magento Open Source contain an unauthenticated template injection flaw (CWE-1336, CVSS 10.0, critical). The CVE record states that an attacker can execute arbitrary code in the context of the current user and gain elevated access or control over a session, without user interaction. Adobe rates the bulletin priority 2 and reports no known exploitation in the wild, but a public proof of concept exists; the public lab shows directive injection via guest GraphQL requests, and its command execution requires a labelled synthetic gadget.

Affected

• Adobe Commerce: 2.4.4 to 2.4.9-2026-sep and earlier
• Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3-2026-sep and earlier
• Magento Open Source: 2.4.6 to 2.4.9-2026-sep and earlier according to the Adobe bulletin; the CVE record lists 2.4.7 to 2.4.9-2026-sep. Verify the range in the bulletin.

Fixed in

• Adobe Commerce: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
• Adobe Commerce B2B: 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
• Magento Open Source: 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct; the bulletin lists no fixed 2.4.6 release
• Prerequisite: September hotfix for CVE-2026-75650 (APSB26-146)

Workaround

• No vendor workaround published.
• Interim measures (own assessment, not vendor guidance): restrict admin and API access, place a WAF in front of the store, and review customised email templates.

Exploitation

• Adobe is not aware of exploits in the wild for any issue in the bulletin. No confirmed in-the-wild exploitation has been reported.
• A public proof of concept exists. CISA SSVC data: exploitation 'poc', automatable yes, technical impact total.
• Sansec said attacks had not yet been observed but expected them.

Our recommendation

• Identify all Adobe Commerce, B2B and Magento Open Source installations, including staging systems and agency-hosted stores.
• Apply the September hotfix for CVE-2026-75650 first, then the October security update or isolated patch from Adobe, and the B2B patch where applicable.
• Test the update with custom extensions and email templates in staging, then roll out promptly; given the public PoC and the lack of login requirement, do not wait the full 30-day window.
• Upgrade Magento Open Source 2.4.6 installations to a supported, fixed release line.
• Review logs for unusual GraphQL requests and unexpected email content, and restrict admin access in the meantime.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  dinosn/cve-2026-103849-blockstrap-lab

Research sources

• Adobe Security Bulletin APSB26-153 www.adobe.com
• CVE-2026-103849 reproduction lab (GitHub) github.com
• CVE-2026-103849 record mirror (OpenCVE) app.opencve.io
• BleepingComputer: critical BlockStrap flaw www.bleepingcomputer.com
• Ionix threat center: CVE-2026-103849 www.ionix.io
• ICE Cube Digital: APSB26-153 patch www.icecubedigital.com
• AIMS InfoSoft: APSB26-153 patch guide www.aimsinfosoft.com
• CyCognito: CVE-2026-103849 analysis www.cycognito.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:24.