Adobe Patches CVSS 10.0 Template Injection in Commerce and Critical ColdFusion Flaws

Adobe has released a set of priority security updates for its enterprise software, headlined by a maximum-severity template injection vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw is tracked as CVE-2026-103849, and it enables a remote, unauthenticated attacker to execute arbitrary code on a server handling the request, earning a CVSS v3.1 base score of 10.0 — the top of the scale. Adobe published the fix Monday, October 13, under security bulletin APSB26-153, alongside a second update for a different product line, Adobe ColdFusion, that closes a separate collection of critical flaws.

The flaw at the center

The Commerce vulnerability is classified as CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine. Special elements passed into the template engine are not properly neutralized, allowing an attacker to inject template directives that the server evaluates and executes. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H says the attack is network-based with low complexity, requires no privileges and no user interaction, and extends impact beyond the vulnerable component with high consequences for confidentiality, integrity, and availability. A 10.0 is rare because every one of the nine CVSS factors has to point in the worst direction, and the absence of any precondition makes this one of the most attractive remote code execution primitives available for targeting internet-facing e-commerce infrastructure.

The bulletin contains more than the headline. APSB26-153 fixes critical, high, and medium severity flaws that could result in arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass, including stored cross-site scripting issue CVE-2026-100133, rated critical at CVSS 9.3 with privilege escalation possible without authentication. The update applies to Commerce and Magento Open Source versions 2.4.4 through 2.4.9, and Adobe released it as an isolated security fix rather than a standard patch cycle. According to Adobe’s accompanying note, operators must install the September hotfix for CVE-2026-75650 in addition to the October patch, and Adobe strongly recommends rotating encryption keys and associated credentials as part of remediation.

ColdFusion receives its own cluster of critical fixes

Adobe’s second update of the cycle, APSB26-144, addresses Adobe ColdFusion. It resolves vulnerabilities rated critical, high, and important, including server-side request forgery and unrestricted file upload flaws scoring 10.0, according to third-party analysis of the bulletin. Other disclosed entries include a high-severity SSRF vulnerability rated 8.6 (CVE-2026-105897), an XML external entity flaw enabling arbitrary file system read (CVE-2026-106616), and multiple denial-of-service issues. ColdFusion is a legacy application server with a broad installed base of internet-facing enterprise and mid-market applications, and the combination of SSRF and file upload weaknesses in a single bulletin deserves attention: SSRF flaws routinely point attackers at internal-only endpoints and cloud metadata services, and the resulting foothold can be chained into full code execution.

This update lands just over a month after Adobe patched CVE-2026-75650, an actively exploited RCE in the same product line that was itself a template engine flaw scored 10.0. That sequence reinforces a structural point about the Magento ecosystem: an unauthenticated remote code execution in a public shopping cart is one of the shortest paths from an anonymous web request to full store compromise. Attackers who land a foothold commonly deploy web shells, inject skimmer scripts into checkout flows — the technique behind the recurring Magecart campaigns — and plant persistence in scheduled tasks, so the ability to exfiltrate card data and customer records persists well after the RCE itself is patched.

Why attackers will prioritize this

• No authentication or user interaction is required, so any internet-exposed Commerce, Commerce B2B, or Magento instance is a valid target.
• The template injection primitive executes arbitrary code in the context of the current server user, collapsing the usual privilege-escalation steps into one request.
• The e-commerce context is inherently high-value: a single store can hold payment card data, customer records, and administrative access to the storefront platform.
• The same product line was actively exploited a month ago via the same weakness type, meaning scanners and exploit kits are already aimed at this exact attack surface.
• Adobe's explicit recommendation to rotate encryption keys and credentials signals that compromised stores should assume their secrets are already in attacker hands.

What this means for you

Sources: Adobe Security Bulletin APSB26-153: Security update available for Adobe Commerce; Adobe Security Bulletin APSB26-144: Security update available for Adobe ColdFusion; SANS ISC Stormcast, October 14, 2026: October Patch Tuesday analysis.

Corrections: Report an error at corrections@wireshaman.com.