CVE-2026-103849

Adobe Commerce suffers from an unpatched template engine vulnerability allowing arbitrary code execution without user interaction.

This critical CVE exposes Adobe Commerce to remote code execution, enabling attackers to gain elevated access or control over accounts and sessions without requiring user interaction. DIB organizations using Adobe Commerce must immediately patch this flaw to prevent exploitation in the wild and avoid compliance failures under NIST 800-171 for unpatched critical vulnerabilities. The lack of user interaction requirement significantly increases the attack surface and potential for automated exploitation.

Shame score — A critical CVSS 10.0 vulnerability in a widely used e-commerce platform that allows arbitrary code execution without user interaction represents a severe, avoidable security failure that could lead to mass data breaches and ransomware attacks.