BREAKING: New no-login code execution bug in Magento and Adobe Commerce (CVE-2026-103849)

Adobe Commerce and Magento Open Source have a new bug that lets someone run code on your store server without logging in. Adobe published APSB26-153 on 2026-10-13. The top issue, CVE-2026-103849, is rated CVSS 10.0, needs no account and no click from anyone on your team. A second one, CVE-2026-92909 (CVSS 9.8), also needs no login and hits stores running the B2B module. Adobe says it is not aware of exploitation in the wild yet. Last month's bug in the same class was being used against live stores before a fix existed, so treat this as this-week work, not next-sprint work.

This post is our operator read of Adobe's APSB26-153 bulletin. The HOL Guard evidence pack for CVE-2026-103849 is the source record.

How to fix

Move to the October build for the release line you are on. Adobe names them by line and month, so you are looking for the -2026-oct build that matches your current -2026-sep (or older) version.

On a Composer install the flow is the usual one. Use the exact version string your repo.magento.com credentials show for your line:

composer require-commerce magento/product-community-edition <your-line>-2026-oct --no-update
composer update
bin/magento setup:upgrade
bin/magento cache:flush

Swap in magento/product-enterprise-edition if you run Adobe Commerce rather than Open Source.

The October update does not replace September's hotfix

This is the line in the bulletin most teams will miss. Adobe writes that on September 7 it shipped an emergency fix for CVE-2026-75650, and tells merchants to "apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin." So a store that installs the October build and stops there can still be missing the September hotfix (VULN-39341) for the StyleSmuggler bug, which was exploited in the wild.

The two bugs also share a category. Adobe files CVE-2026-103849 under the same weakness it used for StyleSmuggler: improper neutralization of special elements in a template engine (CWE-1336), no authentication, scope changed. Adobe has not said whether the new one is related, and has not published technical details. What we can say is that attackers spent September learning exactly where Magento's template rendering can be pushed into running code, and a fresh critical in that same area is the kind of diff people read closely.

Who is not in scope

• Stores that are not Adobe Commerce or Magento Open Source. Shopify, WooCommerce, BigCommerce and Magento 1 are outside APSB26-153.
• Stores without the B2B module, for CVE-2026-92909 specifically. Adobe marks that issue "B2B" in the bulletin. CVE-2026-103849 has no such note, so it applies to plain Commerce and Open Source installs.
• Anyone already on 2.4.10-alpha1 or a 2026-oct build. Adobe lists those as the fixed versions.

One gap to watch: the bulletin lists Magento Open Source 2.4.6 (September build and earlier) as affected, but the fixed builds Adobe and the CVE record name for Open Source start at 2.4.7. If you are still on Open Source 2.4.6, plan the move up a line rather than waiting for a 2.4.6 October build that is not listed.

One operator check

Confirm both fixes on every environment that serves traffic, including staging stores with a public hostname:

composer show magento/product-community-edition magento/product-enterprise-edition 2>/dev/null | grep -E '^(name|versions)'
vendor/bin/magento-patches -n status | grep 39341

You want two answers: a version ending in -2026-oct (or 2.4.10-alpha1), and VULN-39341 showing as applied. A store with only one of the two is still exposed to one of these bugs.

What this is not

This is not a confirmed active attack. Adobe rates APSB26-153 Priority 2 and says it is not aware of exploits in the wild, and no public exploit code is referenced. It is also not limited to admin users: the two criticals above need no login, unlike CVE-2026-92464 (CVSS 9.1), which requires high privileges.

The details

• CVE-2026-103849: template engine injection (CWE-1336), arbitrary code execution, CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Reported by vozec.
• CVE-2026-92909: incorrect authorization (CWE-863), arbitrary code execution, CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, marked B2B. Reported by g4mb4.
• Also in the bulletin: two stored XSS bugs rated 9.3 that need no login but do need a victim to view the page (CVE-2026-91013, CVE-2026-100133), an admin-level code execution bug (CVE-2026-92464), an admin-level file write (CVE-2026-95631), and several B2B authorization bypasses. One upgrade covers all of them.
• Exploitation: none known per Adobe as of 2026-10-13. Not on CISA KEV.

A Magento server holds customer records, order history, payment integration keys and the checkout page itself. Code execution there is how card skimmers get planted. Patch, confirm the September hotfix is still in place, and check again after your next deploy in case a rebuild dropped the patch.

References

• Adobe Security Bulletin APSB26-153
• CVE-2026-103849 on CVE.org
• CVE-2026-92909 on CVE.org
• Our write-up of last month's StyleSmuggler bug, CVE-2026-75650