{"type":"bundle","id":"bundle--b7863bcf-78f9-5f2e-9bc4-dc7df6df30cd","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--b7134ea1-548d-5e00-b9ad-a7f4e4b7b981","created":"2026-10-13T19:00:30.507Z","modified":"2026-10-13T19:00:30.507Z","name":"No-login code execution in Magento and Adobe Commerce, fixed in October 2026 update (CVE-2026-103849)","description":"Adobe published APSB26-153 on 2026-10-13 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CVE-2026-103849 (CWE-1336, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C) allows arbitrary code execution without authentication. CVE-2026-92909 (CWE-863, CVSS 9.8, no authentication) is marked B2B by Adobe. The bulletin also fixes two stored XSS issues rated 9.3, an admin-level code execution bug (CVE-2026-92464) and B2B authorization bypasses. Adobe rates the update Priority 2 and says it is not aware of exploits in the wild. Fixed builds are 2.4.4-2026-oct through 2.4.9-2026-oct for Commerce, 2.4.7-2026-oct through 2.4.9-2026-oct for Open Source, B2B 1.3.3-2026-oct through 1.5.3-2026-oct, and 2.4.10-alpha1. Adobe instructs merchants to also apply the September hotfix for CVE-2026-75650.","aliases":["CVE-2026-103849","CVE-2026-92909","APSB26-153","Adobe Commerce October 2026 security update","Magento Open Source template engine RCE"],"first_seen":"2026-10-13T18:15:53Z","last_seen":"2026-10-13T18:15:53Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Adobe Security Bulletin APSB26-153","url":"https://www.adobe.com/trust/security/products/commerce/apsb26-153.html"},{"source_name":"NVD CVE-2026-103849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103849"},{"source_name":"NVD CVE-2026-92909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92909"},{"source_name":"HOL blog: New no-login code execution bug in Magento and Adobe Commerce","url":"https://hol.org/blog/cve-2026-103849-adobe-commerce-magento-unauth-rce"},{"source_name":"HOL Guard evidence pack CVE-2026-103849","url":"https://hol.org/guard/security/cves/CVE-2026-103849"}]}]}