Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Adobe Commerce has a critical flaw in how it handles template code, allowing attackers to run malicious commands on the server without needing to trick users into doing anything. This can give attackers complete control over the website and customer data.
The vulnerability involves improper sanitization of template engine input (CWE-1336), enabling arbitrary code execution in the application context. Exploitation requires no user interaction and has changed scope, meaning attackers can affect resources beyond the vulnerable component itself. The attack vector is likely network-based through template injection.