Adobe Commerce CVE-2026-103849

Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), this is characterized as remote, unauthenticated exploitation requiring no user interaction against Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The concrete prerequisite is that attacker-controlled input must reach a feature that passes data through the template engine (CWE-1336), but the advisory snippet does not name the exact template feature, parameter, or storefront/admin surface involved. Limiting factors to assess: the description states execution occurs 'in the context of the current user' and references 'the victim's account or session,' which may imply a session/account dependency not reflected in the PR:N rating; the specific affected version ranges are not provided, so exposure depends on the deployment running an unpatched release listed in APSB26-153.

This is a genuine top-priority vulnerability. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst case: network-reachable, low-complexity, no privileges, no user interaction, with a scope change and full confidentiality/integrity/availability impact. CWE-1336 (server-side template injection) combined with the stated arbitrary code execution means full server compromise is the realistic outcome. However, the exploitation signals are currently thin and should temper 'drop-everything' framing: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. One internal tension to verify with the vendor: the description says code executes 'in the context of the current user' and references 'the victim's account or session,' which reads like a user-context/privilege nuance, yet the CVSS vector asserts PR:N/UI:N (fully unauthenticated, no interaction) - these are not obviously consistent for a template-injection flaw, and historically many Magento/Commerce SSTI issues live behind authenticated admin template-editing features. Treat the unauthenticated-no-interaction characterization as vendor-asserted until the APSB26-153 advisory detail confirms the exact injection surface.

A remote attacker submits input that reaches a vulnerable template-processing path in Adobe Commerce/Magento and injects template-engine syntax that the server evaluates, achieving server-side code execution. Because scope is changed, the attacker can pivot beyond the application to the underlying host or other hosted components. No public exploit code was identified at time of analysis, but SSTI-to-RCE patterns in this platform are well understood and low-complexity per the CVSS vector.