Adobe Commerce EUVD-2026-72530

No special conditions - remote unauthenticated exploitation against default network-reachable deployments of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source (AV:N/AC:L/PR:N/UI:N). Exploitation requires only that the storefront or its admin/CMS/email-template rendering path is reachable and that input reaches the vulnerable template engine; there is no authentication, privilege, or user-interaction prerequisite. The primary limiting factor is network reachability to the affected instance and running an unpatched vulnerable version as enumerated in APSB26-146; the changed scope indicates successful exploitation can affect resources beyond the initially vulnerable component.

This is a genuine top-tier priority, not an inflated score. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects unauthenticated, low-complexity, network-reachable code execution with full confidentiality, integrity, and availability impact and a scope change (the compromised template engine crosses a security boundary to affect the wider host/security authority). SSTI-to-RCE in an internet-facing storefront is the archetype of a mass-exploitable flaw once details are public, so any mid-sized commerce operator should treat this as urgent and patch out-of-band. EPSS is not provided and the CVE is not listed in CISA KEV, and no proof-of-concept is referenced, so there is currently no evidence of active exploitation - but Magento/Commerce has a long history of rapid weaponization after advisory release (e.g. prior TrojanOrders/CosmicSting campaigns), so absence of a POC today should not lower urgency. The only conflicting signal is the missing version data: the CPEs use wildcard versions, so exact affected/fixed builds must be confirmed against APSB26-146 before scoping.

An attacker sends a crafted request containing malicious template directives to an internet-facing Adobe Commerce store - for example embedding an SSTI payload in an input field that later flows into template rendering - with no login and no user interaction required. The template engine evaluates the injected directive, executing attacker-controlled PHP code that can plant a webshell, harvest customer/payment data, or pivot deeper. No public POC is currently referenced, but the CVSS 10.0 profile indicates trivial exploitation once details circulate.