NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedUpdated

CVE-2026-103849

A further template-engine injection flaw in Adobe Commerce and Magento permits code execution without logging in and is identified by Sansec as a bypass of the StyleSmuggler hotfix.

What to do

There is no device update for shoppers. If your family or business runs an Adobe Commerce or Magento shop, ask its developer or hosting provider to apply and verify hotfix VULN-39341 alongside the October security fixes. Have them check for existing compromise and follow Adobe's encryption-key and credential-rotation instructions.

Affects
Adobe Commerce, Adobe Commerce B2B and Magento Open Source
Severity
Critical · CVSS 10.0
Fixed in
CVE-2026-75650: Adobe hotfix VULN-39341, using the version-specific patch in Adobe's APSB26-146 installation instructions; it remains separate from September and October isolated security patches.
CVE-2026-103849 — Adobe Commerce: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct; also 2.4.10-alpha1.
CVE-2026-103849 — Adobe Commerce B2B: 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct; also 1.5.4-alpha1.
CVE-2026-103849 — Magento Open Source: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct; also 2.4.10-alpha1.
Being used in attacks
Not known to be
Made public
4 Sept 2026

Part of: Adobe Commerce and Magento StyleSmuggler attacks: hotfix and October bypass fixes required

StyleSmuggler, CVE-2026-75650, lets attackers run code on Adobe Commerce and Magento shop servers without logging in. Sansec observed compromises from 4 September and disclosed the flaw on 5 September; Adobe released an emergency hotfix on 7 September. The affected software includes Adobe Commerce, its B2B component and Magento Open Source. Sansec subsequently identified BlockStrap, CVE-2026-103849, as a bypass of the original hotfix; Adobe addressed that flaw in its October security update and reported no known exploitation of the October issues. As at 3 November, remediation still requires the separate StyleSmuggler hotfix alongside the October fixes: Adobe explicitly says its October isolated patch does not include it. Patching does not remove existing backdoors. Adobe also requires rotation of encryption keys and potentially exposed credentials, including those held by payment providers and other connected services. The reviewed reports do not establish how many shoppers were affected.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. Security update available for Adobe Commerce | APSB26-146Adobe · 7 Sept 2026
  2. Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146)Adobe · 21 Sept 2026
  3. Security update available for Adobe Commerce | APSB26-153Adobe · 13 Oct 2026
  4. Security update available for Adobe Commerce - APSB26-153Adobe · 16 Oct 2026
  5. StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attackSansec · 5 Sept 2026
  6. StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-dayTenable · 8 Sept 2026
  7. CISA Known Exploited Vulnerabilities catalogue — official data feedCISA · 3 Nov 2026
  8. Security update available for Adobe Commerce - APSB26-138Adobe · 14 Oct 2026
Also: CVE-2026-103849 at CVE.org · NVD · Every flaw being used in attacks · Everything live