critical CVSS 10 EPSS 0.8%

the October template-injection flaw

CVE-2026-103849 APSB26-153 Adobe Commerce / Magento 2.x

If it is missing Adobe's APSB26-153 update of 13 October 2026, a template-injection flaw lets an unauthenticated attacker run code on the server (CVSS 10.0, no login and no user interaction). The same bulletin fixes ten more: four further critical (three of them reachable without a login, one only on B2B), five high and one medium. Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9 are affected, including the September 2026 releases. Adobe knew of no exploitation when it published, but the last template injection in Magento, StyleSmuggler, was in use within days. Verify the exact patch level.

Is my store affected?

A free passive scan tells you whether your store is on an affected line, along with everything else we can see from outside. It takes under a minute and needs no account.

How we detect this

We infer the platform and version line from signals the storefront serves publicly: the version endpoint when it is reachable, markup and cookie markers when it is not, and the fingerprints of static assets that changed between releases. If that line is one CVE-2026-103849 affects, we say so.

We do not attempt to exploit it, and we never claim a store is vulnerable from a version string alone. A patched store and an unpatched one on the same release look identical from outside, so the finding is marked inferred and phrased as something to verify. It does not affect your grade.

How to fix it

Take Adobe's October 2026 security release for your line, or apply the October isolated patch, and keep the StyleSmuggler hotfix in place: Adobe asks for both.

1
Find your exact version. The isolated patch only fits the latest security release of each line (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18), so this decides which route you take.
```
bin/magento --version
```
2
Take the October 2026 security release for your line, which is the route Adobe recommends. Use your edition's metapackage and the exact version from the advisory.
```
composer require magento/product-<your-edition>-edition:<2026-oct-release> --no-update && composer update --with-dependencies
```
3
If you cannot take the release yet: download the October isolated patch for your version from Adobe's knowledge-base article ka-49323 (for example 2-4-8-p5-oct-2026.zip) and unzip it in the Magento root. It holds one file per component; apply the core one always, the Commerce one on Adobe Commerce, and the B2B and Page Builder ones only if those are installed. The dry run must pass before the real one.
```
patch -p1 --dry-run < <patch-file> && patch -p1 < <patch-file>
```
4
Adobe asks for the September StyleSmuggler hotfix as well as this update. Confirm it is applied; if it is not, apply it now.
```
vendor/bin/magento-patches -n status | grep -i 39341 || vendor/bin/magento-patches apply VULN-39341
```
5
Rebuild so the patched code is compiled and served. This publishes the change the previous steps made; skip static-content:deploy in developer mode.
```
bin/magento setup:upgrade && bin/magento setup:di:compile && bin/magento setup:static-content:deploy -f && bin/magento cache:flush
```
6
Several flaws in this bulletin are stored cross-site scripting that leads to an admin takeover, so check for admin accounts nobody recognises.
```
SELECT user_id, username, email, created, logdate FROM admin_user ORDER BY user_id DESC;
```

Check it worked

bin/magento --version && vendor/bin/magento-patches -n status | grep -i 39341

References

From intelligence vault 2026.10.2, released 2026-10-21. What changed