{"metadata": {"vulnerability": "CVE-2026-103849", "count": 47, "kinds": {"milestone": 8, "sighting": 20, "kev": 0, "other": 19}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T11:27:51.468Z", "date_only": false, "value": "2026-10-01T11:27:51.468Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T17:00:00Z", "date_only": false, "value": "2026-10-13T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-103849", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:15:53.468Z", "date_only": false, "value": "2026-10-13T18:15:53.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T18:15:53.468Z", "date_only": false, "value": "2026-10-13T18:15:53.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / adobe", "record": "CVE-2026-103849", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:35:01.725Z", "date_only": false, "value": "2026-10-13T18:35:01.725291Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117435039821304436", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "f4b05c89-b293-4bbf-abe3-8b58f9596c47", "content": "CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103849https://www.adobe.com/trust/security/products/commerce/apsb26-153.html#adobe #Adobe #AdobeCommerce #AdobeCommerceB2B #MagentoOpenSource#CVE_2026_103849#bot", "url": "https://infosec.exchange/users/cve/statuses/117435039821304436"}, {"timestamp": "2026-10-13T19:17:53Z", "date_only": false, "value": "2026-10-13T19:17:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:17:53.997Z", "date_only": false, "value": "2026-10-13T19:17:53.997", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "published"}, {"timestamp": "2026-10-13T19:33:22.125Z", "date_only": false, "value": "2026-10-13T19:33:22.125227Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxrrlldt3cco", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "ee0729a3-2cdc-40f8-9e1e-53622f43419e", "content": "CVE Radar | CVE-2026-103849 | CVSS 10.0\n\nCritical Adobe Commerce Template Engine Flaw\n\nCVE-2026-103849 is rated Critical with a CVSS 3.1 score of 10.0.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1257", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxrrlldt3cco"}, {"timestamp": "2026-10-13T19:48:53.130Z", "date_only": false, "value": "2026-10-13T19:48:53.130668Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxrshdjyfh2f", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "e32c1fe6-0e9d-46d2-993d-42b6280d1152", "content": "Adobe Commerce products face two critical flaws.\n\u2022 CVE-2026-103849 at CVSS 10\n\u2022 CVE-2026-100133 at 9.3\nMultiple versions across Commerce, B2B, and Magento Open Source require attention.\n\nhttps://thecircuitry.to/article/pair-of-severe-flaws-surface-in-adobe-commerce-products-mv734xbz", "url": "https://bsky.app/profile/thecircuitry.to/post/3mxrshdjyfh2f"}, {"timestamp": "2026-10-13T20:10:00.901Z", "date_only": false, "value": "2026-10-13T20:10:00.901406Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrtn5ambc2z", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "930da458-818f-4706-9795-be8b826ac35f", "content": "\ud83d\udea8 CVE-2026-103849 \u2014 CVSS 10 CRITICAL\n\nAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vuln...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-103849\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrtn5ambc2z"}, {"timestamp": "2026-10-13T21:33:03Z", "date_only": false, "value": "2026-10-13T21:33:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "published"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103849", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T02:30:04.576Z", "date_only": false, "value": "2026-10-14T02:30:04.576742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsiuqdmuh27", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "af569519-7e0e-4d17-945f-b0affdee6ccc", "content": "CVE-2026-103849 - adobe commerce\nAdobe Commerce, including the B2B edition and Magento Open Source, can be tricked into executing attacker\u2011controlled code without any user click. This could let a hacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#adobecommerce #adobe #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsiuqdmuh27"}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T03:18:46Z", "date_only": false, "value": "2026-10-16T03:18:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-adobe-commerce-update-nu", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "ec5d0b39-99fd-4155-ac0b-950de5351fb4", "url": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-adobe-commerce-update-nu"}, {"timestamp": "2026-10-16T05:45:57.851Z", "date_only": false, "value": "2026-10-16T05:45:57.851+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T20:01:19.283Z", "date_only": false, "value": "2026-10-16T20:01:19.283306Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mxzekdvhqp2m", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "52e0ed91-a1ae-4cbb-898e-e7f167fb11d6", "content": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mxzekdvhqp2m"}, {"timestamp": "2026-10-16T20:45:37.964Z", "date_only": false, "value": "2026-10-16T20:45:37.964184Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxzgzllvwp2q", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "674c5278-de54-4dfe-bd66-98d8909da7b9", "content": "BlockStrap \u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001Magento \u30b5\u30fc\u30d0\u30fc\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\n\n\u7814\u7a76\u8005\u3089\u306f\u3001Magento \u3068 Adobe Commerce \u306b\u5f71\u97ff\u3059\u308b\u6700\u9ad8\u6df1\u523b\u5ea6\u306e\u8106\u5f31\u6027\uff08CVE-2026-103849\uff09\u304c\u8fd1\u304f\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u7a81\u304b\u308c\u308b\u3068\u3001\u30b9\u30c8\u30a2\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u4efb\u610f\u306e PHP \u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002 EC \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d\u306e Sansec \u306b\u3088\u308b\u3068\u3001\u300cB", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxzgzllvwp2q"}, {"timestamp": "2026-10-16T20:50:10.421Z", "date_only": false, "value": "2026-10-16T20:50:10.421580Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117452558145561836", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "2fcc78c6-40de-4ff4-bc6d-4c05a53c4bd1", "content": "Critical BlockStrap flaw lets hackers run code on Magento servers\nA maximum-severity vulnerability in Magento and Adobe Commerce (CVE-2026-103849, dubbed BlockStrap) could let attackers execute arbitrary PHP code on store servers, BleepingComputer reports. Security firm Sansec says no attacks have been observed yet, but warns that Adobe\u2019s \u2018priority 2\u2019 rating understates the risk. https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/", "url": "https://infosec.exchange/users/edwardk/statuses/117452558145561836"}, {"timestamp": "2026-10-16T20:50:11.058Z", "date_only": false, "value": "2026-10-16T20:50:11.058524Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxzhbpt55w2p", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "74f24d0f-477e-4cf2-a6cd-6f8bacdc884d", "content": "Critical BlockStrap flaw lets hackers run code on Magento servers\n\nA maximum-severity vulnerability in Magento and Adobe Commerce (CVE-2026-103849, dubbed BlockStrap) could let attackers execute arbitrary PHP code on sto... https://threatintel.cc/2026/10/16/critical-blockstrap-flaw-lets-hackers.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxzhbpt55w2p"}, {"timestamp": "2026-10-16T20:56:50.836Z", "date_only": false, "value": "2026-10-16T20:56:50.836177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxzhnmy4x62x", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "b1255f0c-54a4-40c4-8736-effeae438091", "content": "Magento/Adobe Commerce\u306bBlockStrap\u8106\u5f31\u6027(CVE-2026-103849)\u304c\u5b58\u5728\u3002\u30b9\u30c8\u30a2\u30b5\u30fc\u30d0\u30fc\u3067\u4efb\u610f\u306ePHP\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308b\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxzhnmy4x62x"}, {"timestamp": "2026-10-16T21:51:39.535Z", "date_only": false, "value": "2026-10-16T21:51:39.535431Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxzkpnmjdo2p", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "980f289c-00a4-4d3d-bc38-8f4471986f5f", "content": "\ud83e\udd16 CVE-2026-103849 (max severity): arbitrary PHP code execution in Magento / Adobe Commerce \u22642.4.9 (B2B \u22641.5.3). Sansec found 4 attack paths in under 24h.\nhttps://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxzkpnmjdo2p"}, {"timestamp": "2026-10-17T01:01:30.438Z", "date_only": false, "value": "2026-10-17T01:01:30.438042Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mxzvd4h6yq2a", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "a4156d6d-fd7f-4d3c-b995-25e593953ee9", "content": "BlockStrap \u306e\u91cd\u5927\u8106\u5f31\u6027\u3001Magento \u30b5\u30fc\u30d0\u30fc\u3078\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u8a31\u53ef\n\nMagento \u3068 Adobe Commerce \u306b\u5f71\u97ff\u3059\u308b\u6700\u9ad8\u6df1\u523b\u5ea6\u306e\u8106\u5f31\u6027 CVE-2026-103849 \u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u304c\u4efb\u610f\u306e PHP \u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u3001\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u8981\u3067\u3059\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "url": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mxzvd4h6yq2a"}, {"timestamp": "2026-10-17T10:08:03.968Z", "date_only": false, "value": "2026-10-17T10:08:03.968257Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3my2tug3t2b2l", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "9c851b0d-f80b-44d5-a234-50c57321f8a9", "content": "\ud83e\udd16 CVE-2026-103849 \"BlockStrap\": max-severity RCE in Adobe Commerce/Magento via email template injection. Sansec mapped 4 paths in <24h. Patch: 2026-oct + VULN-39341.\nhttps://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3my2tug3t2b2l"}, {"timestamp": "2026-10-17T11:57:34.033Z", "date_only": false, "value": "2026-10-17T11:57:34.033245Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3my2zyaqyzq27", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "41f7d1f0-c123-42de-a1c0-297737047632", "content": "Critical Magento Flaw Could Let Hackers Execute PHP Code on E-Commerce\u00a0Servers\n\nSecurity researchers warn that CVE-2026-103849, dubbed BlockStrap, could allow unauthenticated attackers to execute arbitrary PHP code on vulnerable Magento and Adobe Commerce servers.", "url": "https://bsky.app/profile/abijita.bsky.social/post/3my2zyaqyzq27"}, {"timestamp": "2026-10-17T13:35:51.474Z", "date_only": false, "value": "2026-10-17T13:35:51.474916Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3my37hzbhs22r", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "e0c87f9c-84ce-45aa-9f59-5dd8c4017ed4", "content": "BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3my37hzbhs22r"}, {"timestamp": "2026-10-17T18:19:37.439Z", "date_only": false, "value": "2026-10-17T18:19:37.439601Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nlzck2x", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "27802b2d-6b76-4321-8a45-4897e006db17", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 43 people\n2. CVE-2026-102764 \u00b7 20 people \ud83d\udd25\n3. CVE-2025-61624 \u00b7 11 people \ud83d\udd25\n4. CVE-2026-103849 \u00b7 8 people\n5. CVE-2026-104736 \u00b7 8 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nlzck2x"}, {"timestamp": "2026-10-17T18:24:53.918Z", "date_only": false, "value": "2026-10-17T18:24:53.918001Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nucwk2x", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "32cf3074-16c5-4161-8565-79212ffa84d0", "content": "4. CVE-2026-103849 \u00b7 8 people\n\ud83d\udfe5 Critical 10.0 \u00b7 Adobe Commerce\n\nAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nucwk2x"}, {"timestamp": "2026-10-19T06:26:18Z", "date_only": false, "value": "2026-10-19T06:26:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-template-injection-vulnerability-adobe-commerce-and-magento-open-source-can-be", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "56f2b8a7-e1ba-4638-b38e-d8054f215e94", "url": "https://ccb.belgium.be/advisories/warning-template-injection-vulnerability-adobe-commerce-and-magento-open-source-can-be"}, {"timestamp": "2026-10-19T15:32:27Z", "date_only": false, "value": "2026-10-19T15:32:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "modified"}, {"timestamp": "2026-10-20T03:55:26.431Z", "date_only": false, "value": "2026-10-20T03:55:26.431Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T03:55:26.431Z", "date_only": false, "value": "2026-10-20T03:55:26.431Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103849", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T04:16:50.633Z", "date_only": false, "value": "2026-10-20T04:16:50.633", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "lastModified"}, {"timestamp": "2026-10-21T12:56:17Z", "date_only": false, "value": "2026-10-21T12:56:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/hryvinskyi/795baeb35f75bac563e85cf87fa98265", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "64a12781-7761-4ffb-8f6b-48ef35502093", "content": "# APSB26-153 (October 2026) Security Patch: backport for Magento Open Source 2.4.6\n\n## Problem\n\n**[APSB26-153](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html)** (13 October 2026) fixes 11 CVEs in Adobe Commerce and Magento Open Source, five of them critical. The most serious is **CVE-2026-103849**, a template engine injection rated CVSS 10 that needs no login.\n\nAdobe lists Open Source 2.4.6 as affected but ships the fix for Open Source only from 2.4.7 onwards. Standard support for 2.4.6 ended on 11 August 2026, and the 2.4.6 isolated patch (`2-4-6-p15-oct-2026.zip`) can only be downloaded with an Adobe Commerce entitlement.\n\nThis gist is Adobe's 2.4.7-p10 Open Source patch (`247p10-2026-10-001-CE`) ported to 2.4.6-p15 and split per Composer package for `cweagans/composer-patches`.\n\n## What the Patch Does\n\n| Package | Change |\n|---------|--------|\n| `magento/framework` | A child template's `{{inlinecss}}` is handed to the root template through an opaque per-request placeholder (new `DeferredDirectiveRegistry`); the old re-parsing of \"signed\" directives is removed. WYSIWYG validator rejects ``, `< /dev/null \\\n    && echo \"$p: applies\" || echo \"$p: DOES NOT APPLY\")\ndone\n```\n\nEvery package must print `applies`. If one does not, stop: your version differs from 2.4.6-p15.\n\n### Step 3: Add to `composer.json`\n\nAdd the following to the `extra.patches` section, **after** any Adobe isolated patches and hotfixes already listed for the same packages:\n\n```json\n{\n    \"extra\": {\n        \"patches\": {\n            \"magento/framework\": {\n                \"APSB26-153 backport (247p10-2026-10-001-CE)\": \"patches/magento/framework/apsb26-153-framework.patch\"\n            },\n            \"magento/module-catalog\": {\n                \"APSB26-153 backport (247p10-2026-10-001-CE)\": \"patches/magento/module-catalog/apsb26-153-module-catalog.patch\"\n            },\n            \"magento/module-customer\": {\n                \"APSB26-153 backport (247p10-2026-10-001-CE)\": \"patches/magento/module-customer/apsb26-153-module-customer.patch\"\n            },\n            \"magento/module-email\": {\n                \"APSB26-153 backport (247p10-2026-10-001-CE)\": \"patches/magento/module-email/apsb26-153-module-email.patch\"\n            },\n            \"magento/module-persistent\": {\n                \"APSB26-153 backport (247p10-2026-10-001-CE)\": \"patches/magento/module-persistent/apsb26-153-module-persistent.patch\"\n            }\n        }\n    }\n}\n```\n\n### Step 4: Apply\n\n```bash\ncomposer install\n# or\ncomposer patches:repatch\n```\n\n### Step 5: Post-install\n\nThe patch adds classes, plugins and constructor arguments, so DI must be recompiled:\n\n```bash\nbin/magento setup:di:compile\nbin/magento cache:flush\n```\n\nNo database changes.\n\n### Step 6: Verify\n\n```bash\ncurl -o test-apsb26-153.php \\\n  \"https://gist.githubusercontent.com/hryvinskyi/795baeb35f75bac563e85cf87fa98265/raw/test-apsb26-153.php\"\n\nphp test-apsb26-153.php\n```\n\nEvery line must read `[PASS]`. The script is read-only.\n\n### Smoke test after deploy\n\n- A transactional email whose child template uses `{{inlinecss}}`\n- Saving and previewing an email template in admin\n- Product mass attribute update in admin\n- Customer password reset\n- Guest checkout with a persistent (\"remember me\") cart\n\n## Side effect: a lock file in the Magento root\n\n`FileLock` now hashes lock names. Magento's code-regeneration lock (`/var/.regenerate.lock`, created with base path `BP`) therefore appears in the Magento root as an empty file named\n`976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228`. Adobe's own 2.4.7 patch behaves the same way. It is harmless; add it to `.gitignore`.\n\n## Security Recommendations\n\n1. **Plan the upgrade to a supported version** (2.4.8 or later): every later 2.4.6 patch needs the same porting, and some may not port at all\n2. **Review email templates** in admin for directives inside URLs or CSS `url()` that you did not write\n3. **Review admin users**: `bin/magento admin:user:list`\n4. **Review access logs** for GraphQL/REST customer searches filtering on `password_hash`, `rp_token` or `confirmation`\n\n## Disclaimer\n\nThis is a community-provided backport, not an Adobe release. Test on a staging environment before applying to production.\n", "url": "https://gist.github.com/hryvinskyi/795baeb35f75bac563e85cf87fa98265"}]}