17 October 2026
Reference: CVE-2026-103849
1. What is being reported?
Researchers have discovered a vulnerability in Adobe Commerce's template system that fails to properly block dangerous code. This means attackers can inject and execute their own commands on the website, potentially taking over accounts or sessions without any user action.
2. What this means in plain English
If your business uses Adobe Commerce for your online shop, this flaw could let cybercriminals access sensitive information or disrupt your website. Because the attack does not require anyone to interact, it is especially risky and could happen quietly.
3. Could this affect a small business?
Small businesses running online stores on Adobe Commerce could be affected, especially if they have not applied recent security updates. Organisations not using Adobe Commerce or similar platforms are unlikely to be impacted.
4. What to do now
- Check if your website uses Adobe Commerce and identify the version.
- Contact your IT provider or web developer to confirm if security patches for this issue have been applied.
- If patches are not yet installed, arrange for them to be applied as soon as possible.
- Monitor your website for any unusual activity and ensure regular backups are in place.
5. Ask your IT provider
Has the latest security update for CVE-2026-103849 been applied to our Adobe Commerce installation to protect against remote code execution?
6. Bottom line
If you use Adobe Commerce, act quickly to ensure your site is patched and secure against this critical vulnerability.
Information based on CISA KEV, NVD and reputable security reporting.