Security Resilience

CVE-2026-103849

Published
13 October 2026
Modified
15 October 2026
CVSS Score v3.1 10.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0078 55th percentile
Risk Priority 75 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-103849 is a critical-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Adobe Commerce (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's…

more

account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CWE(s)
CWE-1336

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1010 Application Window Discovery Discovery
Adversaries may attempt to get a listing of open application windows.
attack.mitre.org →
T1011.001 Exfiltration Over Bluetooth Exfiltration
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-5764Shared CWE-1336
CVE-2026-72716Shared CWE-1336
CVE-2026-34587Shared CWE-1336
CVE-2025-26865Shared CWE-1336
CVE-2025-46731Shared CWE-1336
CVE-2026-75650Shared CWE-1336
CVE-2026-92592Shared CWE-1336
CVE-2025-37729Shared CWE-1336
CVE-2025-54287Shared CWE-1336
CVE-2026-72911Shared CWE-1336

Affected Assets

Adobe
Commerce
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.7
  • V1.3.10

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation partial match

Developer testing and static analysis can discover missing neutralization of template directives.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles require use of safe templating APIs and proper escaping of external input.

SI-10 Information Input Validation partial match

Input validation rejects or sanitizes untrusted data before it reaches the template engine, stopping injection of special syntax.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require proper input neutralization in template engines to prevent injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

References