CVE-2026-103849: critical vulnerability in Adobe Commerce
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 0.8%
from disclosure to weapon5 days
Published on NVDOct 13
1st PoC+5d
exploitation probability
0.8%top 45% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
public PoCs found — 1
githubgithub.com/dinosn/cve-2026-103849-blockstrap-lab★ 3⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Commerce
In the same product, most dangerous first.
CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 94.7%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 87.5%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 3.9%KEVCVE-2025-24434CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 17.2%CVE-2024-20720CRITICALCommand injection in data collector backup due to insufficient patching of CVE-2023-38208EPSS 3.7%