CVE-2026-103849: 
PHP vulnerability analysis and mitigation

CVE-2026-103849 is a Server-Side Template Injection (SSTI) vulnerability in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B, classified as Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). It allows unauthenticated remote attackers to execute arbitrary code in the context of the current user, with scope change enabling potential privilege escalation or account takeover. Affected versions include Adobe Commerce up to 2.4.9-2026-sep through 2.4.4-2026-sep, Magento Open Source up to 2.4.9-2026-sep through 2.4.7-2026-sep, and Adobe Commerce B2B up to 1.5.3-2026-sep through 1.3.3-2026-sep. The vulnerability was published on October 13, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) (Feedly, Adobe Advisory).

The root cause is improper neutralization of special elements within Adobe Commerce's template engine (CWE-1336), enabling server-side template injection (SSTI). An attacker can craft malicious input that is interpreted and executed by the template engine rather than treated as data, leading to arbitrary code execution. No authentication, user interaction, or elevated privileges are required, and the changed scope indicates that the impact can extend beyond the vulnerable component itself — for example, affecting the underlying operating system or other application components. Sansec published research specifically linking this vulnerability to the Blockstrap Magento RCE attack chain (Sansec Research, Adobe Advisory).

Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected system, as reflected in the CVSS score of 10.0. An unauthenticated attacker can execute arbitrary code remotely, potentially gaining control over the victim's account or session, exfiltrating sensitive customer and payment data, and pivoting to other systems within the network. The changed scope means the impact is not limited to the Commerce application itself but can extend to the underlying server environment (Feedly, Adobe Advisory).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, and no in-the-wild exploitation has been reported in the Feedly threat intelligence data. The EPSS score is approximately 0.78%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability is rated "automatable: yes" by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. CISA KEV catalog status is not confirmed at this time (Feedly, CyCognito Blog).

1. Reconnaissance: Identify internet-facing Adobe Commerce, Magento Open Source, or Adobe Commerce B2B instances running vulnerable versions (e.g., 2.4.4-2026-sep through 2.4.9-2026-sep) using tools like Shodan, Censys, or web crawlers targeting Magento-specific fingerprints.
2. Identify injectable template endpoints: Locate application endpoints that accept user-supplied input rendered through the template engine (e.g., product review fields, contact forms, custom block content, or CMS page fields).
3. Craft SSTI payload: Construct a template injection payload appropriate for the underlying template engine (e.g., Twig or a custom Magento renderer), such as {{7*7}} for detection, then escalate to a code execution payload (e.g., {{['id']|filter('system')}} or equivalent).
4. Submit payload: Send the crafted payload via an unauthenticated HTTP request to the vulnerable endpoint, without requiring any session token or prior authentication.
5. Achieve code execution: Observe the server-side execution of the injected template expression, enabling arbitrary OS command execution, reverse shell establishment, or data exfiltration from the Commerce database (Sansec Research, CyCognito Blog).

• Network: Unusual unauthenticated POST or GET requests to Commerce/Magento template-rendering endpoints containing template syntax characters (e.g., {{, }}, {%, %}); unexpected outbound connections from the web server to external IPs.
• Logs: Web server access logs showing requests with encoded or obfuscated template injection strings in parameters; application error logs referencing template engine evaluation failures or unexpected expression results.
• File System: Newly created PHP web shells or backdoor files in the Magento pub/, var/, or module directories; unexpected modifications to CMS block or layout XML files.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx process (e.g., bash, curl, wget, python, nc); unexpected cron jobs added under the web server user account (Sansec Research).

Adobe has released patched versions addressing this vulnerability: Adobe Commerce 2.4.4-2026-oct through 2.4.9-2026-oct (and 2.4.10-alpha1), Magento Open Source 2.4.7-2026-oct through 2.4.9-2026-oct (and 2.4.10-alpha1), and Adobe Commerce B2B 1.3.3-2026-oct through 1.5.3-2026-oct (and 1.5.4-alpha1). Administrators should apply the October 2026 security patches immediately. As a temporary measure, restrict public access to template-rendering endpoints and implement a Web Application Firewall (WAF) rule to block requests containing template injection syntax. Monitor for anomalous server-side activity as described in the IOCs section (Adobe Advisory, Feedly).

Heise reported on the vulnerability as part of Adobe's October 2026 patch day, highlighting it as a critical risk to Adobe Commerce deployments (Heise). CyCognito published an emerging threat blog post specifically analyzing CVE-2026-103849 and its template injection mechanics (CyCognito Blog). Sansec, a specialist in Magento security, linked the vulnerability to the Blockstrap RCE attack chain in their research (Sansec Research). The vulnerability was also highlighted in the October 2026 Patch Tuesday roundup by CSO Online and Ivanti, underscoring its significance in the broader patch cycle (CSO Online, Ivanti Blog).