External risk intelligence

Adobe Commerce Arbitrary Code Execution via Template Engine

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-103849

Adobe Commerce is an enterprise e-commerce platform designed to serve public-facing web storefronts and APIs. By its core nature and typical deployment pattern, it is intended to be accessible via the public internet to facilitate customer transactions and traffic, placing it directly at the network edge.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Adobe Commerce, a widely used e-commerce platform. The issue involves improper handling of specific code elements, which could allow an attacker to execute arbitrary code. This could potentially lead to unauthorized access or control over user accounts and sessions, impacting the integrity and availability of the e-commerce operations.

Code flaw allows unauthorized code execution.
Affects public-facing e-commerce platforms.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to an Adobe Commerce instance. This request would target a template engine component, leading to the execution of arbitrary code with the privileges of the affected user. If successful, this could allow an attacker to gain elevated access, take control of a user's account, or compromise their session. Exploitation does not require any action from the victim, and the attack can originate from the network.

Accessible via the network.
Malicious input to template engine.
Arbitrary code execution and account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code within the context of the current user. When supported by the advisory, this could lead to elevated access or control over a victim's account or session without requiring user interaction.

Account or session control.
Arbitrary code execution.
Elevated access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Adobe Commerce necessitates immediate action from teams responsible for the e-commerce platform. The first practical step involves asset owners identifying all instances of Adobe Commerce, assessing their public reachability and business criticality, and confirming ownership for remediation planning.

Application owners should take ownership.
Verify public exposure and business criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Commerce?

Adobe Commerce is an enterprise-grade e-commerce platform used by businesses to build and manage online storefronts. It handles critical operations like product catalogs, customer transactions, and payment processing, functioning as the central engine for online retail operations and web-based sales.

What does CWE-1336 mean for CVE-2026-103849?

CWE-1336 refers to the 'Improper Neutralization of Special Elements Used in a Template Engine.' In plain terms, the software fails to properly sanitize or filter instructions sent to its template engine. Because of this flaw, CVE-2026-103849 allows an attacker to inject and execute their own unauthorized commands, tricking the system into running malicious code instead of legitimate site content.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the Adobe Commerce instance. The request specifically targets the system's template engine to force unauthorized code execution. It is important to note that this process does not require any victim interaction, such as clicking a link; the system processes the malicious input automatically upon receipt.

Is my Adobe Commerce instance at risk?

According to Halo Surface Signal, Adobe Commerce is designed for public-facing storefronts and APIs, meaning it is typically exposed to the internet. If your instance is reachable from the public web to facilitate customer traffic, it faces a higher risk of being targeted by this network-based vulnerability compared to internal-only systems.

What are the first steps to handle CVE-2026-103849?

Start by identifying all instances of Adobe Commerce within your environment. Determine which systems are internet-facing and assess their business criticality to prioritize your response. Once mapped, confirm ownership of these assets and prepare to implement vendor-coordinated updates or mitigations to secure your platform against potential unauthorized access.

References

www.adobe.com/trust/security/products/commerce/apsb26-153.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.