{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-0C8FCBBA",
  "slug": "cve-2026-103849-adobe-commerce-magento-unauth-rce",
  "title": "No-login code execution in Magento and Adobe Commerce, fixed in October 2026 update (CVE-2026-103849)",
  "aliases": [
    "CVE-2026-103849",
    "CVE-2026-92909",
    "APSB26-153",
    "Adobe Commerce October 2026 security update",
    "Magento Open Source template engine RCE"
  ],
  "summary": "Adobe published APSB26-153 on 2026-10-13 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CVE-2026-103849 (CWE-1336, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C) allows arbitrary code execution without authentication. CVE-2026-92909 (CWE-863, CVSS 9.8, no authentication) is marked B2B by Adobe. The bulletin also fixes two stored XSS issues rated 9.3, an admin-level code execution bug (CVE-2026-92464) and B2B authorization bypasses. Adobe rates the update Priority 2 and says it is not aware of exploits in the wild. Fixed builds are 2.4.4-2026-oct through 2.4.9-2026-oct for Commerce, 2.4.7-2026-oct through 2.4.9-2026-oct for Open Source, B2B 1.3.3-2026-oct through 1.5.3-2026-oct, and 2.4.10-alpha1. Adobe instructs merchants to also apply the September hotfix for CVE-2026-75650.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Adobe has not published technical details for CVE-2026-103849 or said whether it is related to CVE-2026-75650 (same CWE-1336 class). No exploitation is known as of 2026-10-13. Magento Open Source 2.4.6 is listed as affected but no October Open Source build for 2.4.6 is named.",
  "firstObservedAt": "2026-10-13T18:15:53Z",
  "lastObservedAt": "2026-10-13T18:15:53Z",
  "publishedAt": "2026-10-13T19:00:30.507Z",
  "reviewedAt": "2026-10-13T19:00:15.606Z",
  "expiresAt": "2026-10-13T18:15:53Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "adobe-apsb26-153",
      "label": "Adobe Security Bulletin APSB26-153",
      "url": "https://www.adobe.com/trust/security/products/commerce/apsb26-153.html",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-13T18:00:00Z"
    },
    {
      "id": "nvd-103849",
      "label": "NVD CVE-2026-103849",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103849",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T18:15:53Z"
    },
    {
      "id": "nvd-92909",
      "label": "NVD CVE-2026-92909",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92909",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T18:15:48Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: New no-login code execution bug in Magento and Adobe Commerce",
      "url": "https://hol.org/blog/cve-2026-103849-adobe-commerce-magento-unauth-rce",
      "sourceType": "research",
      "observedAt": "2026-10-13T18:56:10Z"
    },
    {
      "id": "hol-evidence",
      "label": "HOL Guard evidence pack CVE-2026-103849",
      "url": "https://hol.org/guard/security/cves/CVE-2026-103849",
      "sourceType": "other_primary",
      "observedAt": "2026-10-13T18:15:53Z"
    }
  ],
  "artifacts": [
    {
      "id": "adobe-commerce",
      "artifactClass": "package",
      "ecosystem": "composer",
      "name": "Adobe Commerce (magento/product-enterprise-edition)",
      "version": "2.4.4 through 2.4.9, 2026-sep builds and earlier",
      "defanged": false
    },
    {
      "id": "magento-open-source",
      "artifactClass": "package",
      "ecosystem": "composer",
      "name": "Magento Open Source (magento/product-community-edition)",
      "version": "2.4.6 through 2.4.9, 2026-sep builds and earlier",
      "defanged": false
    },
    {
      "id": "adobe-commerce-b2b",
      "artifactClass": "package",
      "ecosystem": "composer",
      "name": "Adobe Commerce B2B",
      "version": "1.3.3 through 1.5.3, 2026-sep builds and earlier",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "t-adobe-bulletin",
      "occurredAt": "2026-10-13T18:00:00Z",
      "eventType": "vendor_action",
      "summary": "Adobe publishes APSB26-153 with fixed 2026-oct builds and 2.4.10-alpha1, Priority 2, no known exploits.",
      "sourceIds": [
        "adobe-apsb26-153"
      ]
    },
    {
      "id": "t-cve-published",
      "occurredAt": "2026-10-13T18:15:53Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-103849 and CVE-2026-92909 published.",
      "sourceIds": [
        "nvd-103849",
        "nvd-92909"
      ]
    },
    {
      "id": "t-hol-blog",
      "occurredAt": "2026-10-13T18:56:10Z",
      "eventType": "other",
      "summary": "HOL publishes operator write-up with version table and a check for both the October build and the September VULN-39341 hotfix.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-covered-server-side-magento",
      "relationship": "not_covered",
      "limitation": "HOL Guard protects AI agent actions on developer machines; it does not patch or shield a Magento server from inbound web requests. Remediation is the Adobe update."
    }
  ],
  "policies": [],
  "limitations": [
    "Not in scope: Shopify, WooCommerce, BigCommerce, Magento 1 and other platforms outside APSB26-153.",
    "CVE-2026-92909 is marked B2B; stores without the B2B module are primarily exposed through CVE-2026-103849.",
    "Stores already on 2.4.10-alpha1 or a 2026-oct build are listed as fixed.",
    "Not a confirmed active attack as of 2026-10-13."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-103849-adobe-commerce-magento-unauth-rce/corrections"
}