Adobe patches CVSS 10 Magento RCE (CVE-2026-103849)

Adobe has patched CVE-2026-103849, an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source scored CVSS 10.0. It is the top item in bulletin APSB26-153, released October 13. No exploitation has been reported yet — but a perfect-score, pre-auth RCE in Magento is the kind of bug that gets weaponized fast, and e-commerce security firm Sansec says it found four plausible attack paths in under 24 hours.

What the bug does

Per Adobe, CVE-2026-103849 is an "improper neutralization of special elements used in a template engine" (CWE-1336) in the email-template engine, leading to arbitrary code execution. It needs no authentication (CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Adobe credits the report to vozec; Sansec, which nicknamed the flaw "BlockStrap," analyzed the exploitation surface.

Affected versions

• Adobe Commerce: 2.4.4 through 2.4.9, all builds "2026-sep and earlier."
• Magento Open Source: 2.4.6 through 2.4.9, all builds "2026-sep and earlier."

Fixed versions

• Adobe Commerce: 2.4.10-alpha1, or 2.4.4–2.4.9 at their 2026-oct builds.
• Magento Open Source: 2.4.10-alpha1, or 2.4.7–2.4.9 at their 2026-oct builds.

Adobe rates the overall bulletin Priority 2 and says it is "not aware of any exploits in the wild for any of the issues addressed in this update."

What to do today

1. Apply the 2026-oct patch. Deploy the October isolated patch for your branch, or move to a fixed build. Don't wait for the Priority 2 label to lull you — the flaw is pre-auth and maxed out at 10.0.
2. Mind the stacking. Adobe says the earlier APSB26-146 hotfix for CVE-2026-75650 should remain applied alongside this update. Sansec cautions that a plain Composer update may not be sufficient on its own — verify the fix is actually present after deployment.
3. Rotate keys. Adobe's guidance for Commerce incidents is to rotate encryption keys and associated credentials as part of remediation. Treat any internet-facing store you can't confirm was patched promptly as suspect and rotate.
4. Watch the email-template surface. The flaw lives in the template engine. Review web-server and application logs for unusual requests to email/template endpoints since the patch dropped.

Context

The Magento ecosystem has a long history of mass-exploited, unauthenticated RCE — the TrojanOrders and CosmicSting campaigns both turned Commerce flaws into widespread card-skimming within days of disclosure. A CVSS 10.0, pre-auth bug fits that mold exactly, which is why the gap between "patch available" and "patch applied" is the only variable that matters here. With Sansec already publicly counting attack paths, the clock is running.