{"id":"CVE-2026-103849","published":"2026-10-13T19:17:53Z","modified":"2026-10-20T04:16:50Z","title":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…","vendor":"Adobe","product":"Adobe Commerce","tier":"core","eol":null,"description":{"text":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","provenance":"source","from":"NVD"},"summary":{"text":"A template-engine injection flaw (improper neutralization of special elements used in a template engine) exists in Adobe Commerce, Adobe's e-commerce platform. An attacker with network access and no authentication or user interaction can achieve arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:01Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0117,"percentile":0.67329,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6acf987fa92372976a324f03","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://www.adobe.com/trust/security/products/commerce/apsb26-153.html","tags":[]},{"url":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-99219","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99219","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-10-18","earliestUrl":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab","repos":[{"name":"dinosn/cve-2026-103849-blockstrap-lab","url":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab","stars":3,"created":"2026-10-18"}]},"first":{"date":"2026-10-18","source":"PoC-in-GitHub","url":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103849","provenance":"source"},{"date":"2026-10-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":27.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.47,"detail":"percentile 0.6733"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}