CVE-2026-103849: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) in Adobe Adobe Commerce

CVE-2026-103849 describes an improper neutralization of special elements used in the template engine of Adobe Commerce. This vulnerability enables arbitrary code execution in the context of the current user, potentially allowing attackers to gain elevated access or control over the victim's account or session. Exploitation does not require user interaction, and the scope of the vulnerability is changed, indicating that the impact extends beyond the initially affected component. The vulnerability is rated critical with a CVSS 3.1 score of 10.0.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially resulting in full compromise of the affected account or session. The vulnerability has a critical impact on confidentiality, integrity, and availability of the system. No user interaction is required, increasing the risk of automated exploitation. The scope change suggests that the attack could affect components beyond the template engine itself.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, monitor Adobe's security advisories for updates and consider applying any recommended temporary mitigations if published.