Adobe Commerce patches critical RCE flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Adobe fixed multiple Adobe Commerce vulnerabilities, including CVSS 10.0 flaws allowing unauthenticated remote code execution, stored XSS and authorization bypass.
NCSC-NL published an advisory summarizing a batch of Adobe Commerce vulnerabilities patched by Adobe, including stored Cross-Site Scripting (XSS) issues that allow injection of malicious JavaScript into form fields, enabling session hijacking or privilege escalation when executed in a victim's browser. More severe are template engine vulnerabilities involving improper neutralization of special elements, which can allow an attacker to execute arbitrary code without any user interaction — two of these carry the maximum CVSS score of 10.0 (CVE-2026-103849 and CVE-2026-75650). Additional issues include incorrect authorization flaws that let low-privileged attackers bypass security controls, perform unauthorized read/write operations, and in some cases achieve remote code execution, as well as input validation weaknesses enabling control bypass across different privilege levels.
Twelve CVEs are listed in total, with CVSS scores ranging from 4.3 to 10.0; eight of them score 8.0 or higher, indicating a dense cluster of high-impact flaws in a single release. The advisory does not report in-the-wild exploitation at this time, but given the severity (unauthenticated RCE via template injection) and the historical popularity of Adobe Commerce/Magento as a target for e-commerce attackers, rapid patching is strongly recommended. Defenders running Adobe Commerce should apply Adobe's security updates immediately and monitor for post-authentication anomalies, unusual template rendering behavior, and unexpected admin-level actions consistent with authorization bypass.
No threat actor, malware family, or active campaign is named in this advisory; it is a vendor patch bulletin relayed by the Dutch national CERT. Organizations using Adobe Commerce (and Magento-based storefronts) should treat this as a priority patching action given the number of critical/near-critical CVSS scores involved.
Mentioned in this report
Detection guidance
Web Server or PHP-FPM Process Spawning Shell With Recon or Download Commands
Detects a web server or PHP worker spawning a Unix shell that runs download, reverse-shell or recon commands, typical of post-exploitation after RCE (e.g. template injection) in a PHP e-commerce application such as Adobe Commerce/Magento. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP-FPM Process Spawning Shell With Recon or Download Commands
description: Detects a web server or PHP worker (php-fpm, apache, nginx) spawning
a Unix shell that runs download, reverse-shell or recon commands. This is typical
post-exploitation behaviour after RCE in a PHP e-commerce application such as Adobe
Commerce/Magento. The advisory names no in-the-wild exploitation, so the rule generalises
on the web-process-to-shell-to-attacker-tooling pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- php-fpm
- /apache2
- /httpd
- /nginx
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- base64 -d
- nc -e
- whoami
- chmod +x /tmp
- chmod 777 /tmp
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Deployment or health-check scripts invoked by PHP that legitimately call curl or
wget through a shell
- Administrators running diagnostic commands through a web-based management panel
level: medium
id: e46796c8-9893-59ca-a13c-5df3d4dcffb6
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0436.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0436.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs