CVE-2026-103849

Executive Summary

CVE-2026-103849 is a critical (CVSS 10.0) server-side template injection (SSTI) vulnerability in Adobe Commerce, tracked as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). It allows an unauthenticated, remote attacker to achieve arbitrary code execution in the context of the current user, with no user interaction required and a changed scope, meaning the compromise can pivot beyond the vulnerable component to impact the broader host and application trust boundary. Because no patch, workaround, or version range has been published by any tracked source, Adobe Commerce deployments should be treated as fully exposed until vendor guidance is confirmed. Any internet-facing Adobe Commerce instance is a candidate target.

Technical Analysis

The vulnerability class is template injection. Adobe Commerce (the commercial platform derived from Magento) renders content through template engines — server-side engines that evaluate expressions embedded in template files. CWE-1336 occurs when user-controllable input is incorporated into a template and then evaluated by that engine without proper neutralization of template syntax.

The NVD description does not disclose the specific template engine, the affected module, the injectable parameter, or the vulnerable file path. No CNA title, affected version range, or OSV package mapping was provided. Accordingly, the following is a vulnerability-class analysis rather than a code-level account of this specific instance:

• Mechanism: A server-side template engine receives attacker-influenced input and treats template control syntax (delimiters, expression tags, function or filter callouts) as executable directives rather than literal data. The engine then evaluates that syntax during rendering.
• Consequence: Where the template engine exposes language-level constructs, evaluation can escalate from data disclosure to arbitrary code execution in the rendering process's security context. The CVSS vector records high confidentiality, integrity, and availability impact (C:H/I:H/A:H) and a changed scope (S:C), consistent with code execution that can escape the original vulnerable component.
• Preconditions: AV:N (network reachable), AC:L (no special conditions), PR:N (no authentication), UI:N (no victim interaction). The attacker only needs network reachability to the vulnerable surface.
• Primitive class: Arbitrary code execution "in the context of the current user," which the description notes could yield elevated access or control over the victim's account or session.

Template injection differs from injection into a datastore or interpreter in that the exploit payload must conform to the template engine's expression grammar. This typically means an attacker first probes for reflected control syntax, then escalates to engine-specific expressions. Public research on Adobe Commerce/Magento SSTI has historically involved rendering endpoints and CMS-driven content paths, but no endpoint, parameter, class, or method name for CVE-2026-103849 is available in the provided data, and none is asserted here.

Exploitation Scenarios

No public proof of concept, Nuclei template, or exploit code exists for this CVE. The chain below is inferred from the CWE-1336 class and the CVSS vector; it deliberately omits any invented function names, parameters, file paths, or endpoints.

1. Reconnaissance / target identification. The attacker enumerates internet-facing Adobe Commerce storefronts using Shodan-style fingerprinting (e.g., product:"Adobe Commerce", http.title:"Adobe Commerce", Magento-specific static asset paths). Because the flaw is pre-authentication (PR:N) and requires no interaction (UI:N), no account or victim is needed to attempt exploitation — only reachability of the vulnerable rendering surface.
2. Triggering the flaw class. The attacker submits input crafted to be interpreted as template syntax by the server-side template engine at a surface where user-supplied content is rendered. Because the specific injectable parameter is not disclosed, the class-level approach is to identify any request whose value is later embedded in a server-rendered template and to test whether template control delimiters are evaluated rather than escaped. Successful evaluation (e.g., arithmetic or expression resolution reflected in the response) confirms the injection primitive.
3. Payload / execution method. With template control syntax accepted, the attacker submits expressions that the engine's language exposes for computation and object access, escalating toward code or command execution. The exact expression grammar is engine-specific and not specified in the available data; the defining characteristic is that a single unauthenticated request causes the server to evaluate attacker-directed template code, yielding code execution in the current user's context (no UI:N step required).
4. Post-exploitation impact. Per the description and vector, the attacker gains arbitrary code execution in the current user's security context, potentially escalating to elevated access or control over the victim's account or session. With changed scope (S:C), the impact is not confined to the original component: the attacker can act beyond the vulnerable boundary — for example, manipulating sessions/accounts, accessing application data, or using the execution context as a foothold for further host-level activity. Availability is also impacted (A:H), consistent with an attacker able to disrupt or terminate the rendering process.

Attempting this chain against systems you do not own or have written authorization to test is unlawful.

Impact Assessment

• Base score: 10.0 (Critical) — the maximum CVSS 3.1 base score.
• Confidentiality (C:H): Full read access to data reachable by the executing context, including application configuration and, in a commerce context, customer and order data.
• Integrity (I:H): Arbitrary modification capability in the execution context; templates and application logic could be manipulated.
• Availability (A:H): Potential to disrupt or destroy service/process availability.
• Exploitability: AV:N / AC:L / PR:N / UI:N — trivially reachable, unauthenticated, no user action; the lowest possible attack complexity barrier.
• Scope (S:C): Impact crosses the component's security authority, so downstream account, session, and host resources are in blast radius.
• Affected systems: Adobe Commerce storefronts and any deployment exposing the vulnerable rendering surface to untrusted networks. Hosting posture matters: internet-facing production stores present the largest blast radius; segmented internal-only deployments present a smaller one.
• Business impact: For a commerce platform, post-exploitation exposure typically includes customer PII, payment-adjacent data, administrative sessions, and storefront integrity. Given the 10.0 rating and pre-auth nature, this warrants highest-priority treatment for any exposed instance.
• Real-world status: No EPSS score is yet published by FIRST.org; CISA KEV does not list this CVE; no public exploit code is known. Absence of PoC/KEV does not reduce urgency given the 10.0 rating and lack of a patch.

Detection Guidance

Detection must target both the application layer (template syntax reaching a render sink) and the network/endpoint layer (anomalous characters and post-exploitation behavior). Because no CVE-specific IoCs exist, the rules below detect the vulnerability class and generic web-shell/post-exploitation patterns, not a confirmed payload string.

Sigma Rule

title: Potential Server-Side Template Injection in Adobe Commerce (CVE-2026-103849)
id: 3f9a1c72-6b4e-4d2a-9c11-0a7e5f2b8d10
status: experimental
description: Detects template-control syntax in HTTP requests to Adobe Commerce, consistent with CWE-1336 SSTI exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103849
author: valtersit.com SOC
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_ssti:
    cs-uri-query|contains:
      - '{{'
      - '}}'
      - '${'
      - '<%='
      - '#{'
      - '{%'
      - '%}'
  selection_body:
    cs-body|contains:
      - '{{'
      - '${'
      - '{%'
  filter_static:
    cs-uri-ext:
      - css
      - js
      - png
      - jpg
      - ico
  condition: selection_method and (selection_ssti or selection_body) and not filter_static
falsepositives:
  - Legitimate templating or CMS content submission containing braces
  - Security scanners and fuzzers
level: high
tags:
  - attack.t1190
  - cwe.1336

YARA Rule

rule CVE_2026_103849_SSTI_Indicators
{
    meta:
        author = "valtersit.com SOC"
        description = "Detects common server-side template injection payload patterns and web-shell artifacts consistent with CWE-1336 exploitation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103849"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ssti1 = "{{" ascii
        $ssti2 = "}}" ascii
        $ssti3 = "${" ascii
        $ssti4 = "{%" ascii
        $ssti5 = "<%=" ascii
        $ssti6 = "#{" ascii
        $cmd1  = "system(" ascii
        $cmd2  = "exec(" ascii
        $cmd3  = "passthru(" ascii
        $cmd4  = "shell_exec(" ascii
        $eval1 = "eval(" ascii

    condition:
        uint32(0) != 0x04034b50 and
        (2 of ($ssti*)) and (1 of ($cmd*, $eval1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103849 Adobe Commerce Potential SSTI Attempt (template control syntax in request)"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; pcre:"/(%7B%7B|\{\{|\$\{|%24%7B|<%=|#\{|%\{%7C)/i"; http.request_body; pcre:"/(\{\{|\$\{|<%=|#\{)/i"; classtype:web-application-attack; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103849; sid:2026103849; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where
      http.request.method in ("GET", "POST") and
      (http.request.query contains "{{" or http.request.query contains "${" or
       http.request.query contains "{%"  or http.request.query contains "<%=") ]
  [ network where
      http.response.status_code == 200 and
      http.request.method in ("GET", "POST") ]

Splunk SPL Query

index=web sourcetype=access_common
| eval raw = _raw
| where match(raw, "(?i)(%7B%7B|\{\{|\$\{|%24%7B|%3C%25=|<%=|#\{|%\{%7C)")
| rex field=clientip "(?<src_ip>[^\s]+)"
| stats count values(uri) as suspects values(status) as codes by src_ip
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-103849,">
  <rule id="100849" level="12">
    <if_sid>31100</if_sid>
    <regex type="pcre2">(?i)(%7B%7B|\{\{|\$\{|%24%7B|&lt;%=|#\{|%\{%7C)</regex>
    <description>CVE-2026-103849: Potential Adobe Commerce SSTI attempt - template control syntax detected in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_6.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or affected-version range is available from any tracked source (NVD, vendor advisory, OSV). Treat all Adobe Commerce deployments as potentially vulnerable until Adobe publishes an advisory.

1. Immediate mitigations (no patch available):

   • Apply a web application firewall (WAF) in front of all Adobe Commerce storefronts and enable virtual patching for template-injection patterns (template control delimiters {{ }}, ${ }, {% %}, <%= %>, #{ } in user-controlled inputs, especially query strings and request bodies).
   • Do not delay mitigation waiting for a patch: reduce the attack surface by restricting temporary WAF or proxy rules to block requests carrying template control syntax to rendering endpoints.
   • Harden the execution context: run the web tier with a least-privilege OS user, apply restrictive filesystem permissions, and disable outbound egress from the web tier where feasible to limit post-exploitation reach (consistent with the changed-scope S:C rating).
   • Enforce administrative separation: keep admin panels off the public internet (VPN/allowlist only) and ensure the storefront anchor (front-end) is the only publicly reachable component where the architecture allows.
   • Monitor aggressively for post-exploitation (web-shell writes, unexpected child processes from the web worker, anomalous outbound connections).
   • Increase logging verbosity on the web tier and ship web logs into the SIEM with the detection rules above.

2. Patch / upgrade steps:

   • No patch exists. Monitor Adobe's security bulletin channel and the Adobe Commerce release notes for the version that resolves CVE-2026-103849.
   • When a fix is released, treat it as emergency change: stage, validate business-critical flows, then deploy to all production environments and edge/CDN layers.
   • After patching, re-scan for prior compromise — attackers may have established persistence before the fix.

3. Long-term hardening:

   • Adopt a template-engine allow-listing discipline: never pass raw user input into a template render sink; use parameterized/context-aware rendering and strict input validation.
   • Maintain a formal asset inventory of Adobe Commerce instances/versions so patch SLAs can be enforced when the fix lands.
   • Enforce HTTPS everywhere, rotate secrets and sessions following any suspected exposure, and implement account/session monitoring for the "control over victim's account or session" impact described.
   • Establish an SBOM and dependency-tracking process for the commerce stack (relevant because no OSV package mapping was available for this CVE).
   • Conduct regular authorized penetration testing of the storefront, including SSTI test cases, once a controlled environment can be safely used.

References

• NVD — CVE-2026-103849: https://nvd.nist.gov/vuln/detail/CVE-2026-103849
• CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine: https://cwe.mitre.org/data/definitions/1336.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Adobe Security Bulletins (recommended monitoring for the eventual vendor fix): https://helpx.adobe.com/security/security-bulletin.html
• FIRST EPSS (no score published as of this report): https://www.first.org/epss/

Threat actor / in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing exist for CVE-2026-103849 as of this report. No known threat actor campaign has been attributed. Given the CVSS 10.0 pre-authentication rating and the absence of a patch, the risk of weaponization is elevated once technical details or a fix become public; continuous monitoring of vendor and exploit-intelligence sources is advised.