critical severityConfidence highHistorical record

No-login code execution in Magento and Adobe Commerce, fixed in October 2026 update (CVE-2026-103849)

Adobe published APSB26-153 on 2026-10-13 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CVE-2026-103849 (CWE-1336, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C) allows arbitrary code execution without authentication. CVE-2026-92909 (CWE-863, CVSS 9.8, no authentication) is marked B2B by Adobe. The bulletin also fixes two stored XSS issues rated 9.3, an admin-level code execution bug (CVE-2026-92464) and B2B authorization bypasses. Adobe rates the update Priority 2 and says it is not aware of exploits in the wild. Fixed builds are 2.4.4-2026-oct through 2.4.9-2026-oct for Commerce, 2.4.7-2026-oct through 2.4.9-2026-oct for Open Source, B2B 1.3.3-2026-oct through 1.5.3-2026-oct, and 2.4.10-alpha1. Adobe instructs merchants to also apply the September hotfix for CVE-2026-75650.

Also tracked as CVE-2026-103849 · CVE-2026-92909 · APSB26-153 · Adobe Commerce October 2026 security update · Magento Open Source template engine RCE

First observed
Oct 13, 2026
Last observed
Oct 13, 2026
Last reviewed
Oct 13, 2026
Tracking ended
Oct 13, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Adobe has not published technical details for CVE-2026-103849 or said whether it is related to CVE-2026-75650 (same CWE-1336 class). No exploitation is known as of 2026-10-13. Magento Open Source 2.4.6 is listed as affected but no October Open Source build for 2.4.6 is named.

  • Not in scope: Shopify, WooCommerce, BigCommerce, Magento 1 and other platforms outside APSB26-153.
  • CVE-2026-92909 is marked B2B; stores without the B2B module are primarily exposed through CVE-2026-103849.
  • Stores already on 2.4.10-alpha1 or a 2026-oct build are listed as fixed.
  • Not a confirmed active attack as of 2026-10-13.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard protects AI agent actions on developer machines; it does not patch or shield a Magento server from inbound web requests. Remediation is the Adobe update.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Adobe publishes APSB26-153 with fixed 2026-oct builds and 2.4.10-alpha1, Priority 2, no known exploits.

  2. Disclosure

    CVE-2026-103849 and CVE-2026-92909 published.

  3. Update

    HOL publishes operator write-up with version table and a check for both the October build and the September VULN-39341 hotfix.

Publication clock: 0.7 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Adobe Commerce (magento/product-enterprise-edition)@2.4.4 through 2.4.9, 2026-sep builds and earliercomposerpackage
  • Magento Open Source (magento/product-community-edition)@2.4.6 through 2.4.9, 2026-sep builds and earliercomposerpackage
  • Adobe Commerce B2B@1.3.3 through 1.5.3, 2026-sep builds and earliercomposerpackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-0C8FCBBA