# Adobe Commerce patches critical RCE flaws

Published: 2026-10-16 · Severity: high · Sectors: retail, technology
Canonical: https://vorant.io/reports/1a211364-1e1c-5505-ab32-6dc930f6d010/adobe-commerce-patches-critical-rce-flaws

> Adobe fixed multiple Adobe Commerce vulnerabilities, including CVSS 10.0 flaws allowing unauthenticated remote code execution, stored XSS and authorization bypass.

NCSC-NL published an advisory summarizing a batch of Adobe Commerce vulnerabilities patched by Adobe, including stored Cross-Site Scripting (XSS) issues that allow injection of malicious JavaScript into form fields, enabling session hijacking or privilege escalation when executed in a victim's browser. More severe are template engine vulnerabilities involving improper neutralization of special elements, which can allow an attacker to execute arbitrary code without any user interaction — two of these carry the maximum CVSS score of 10.0 (CVE-2026-103849 and CVE-2026-75650). Additional issues include incorrect authorization flaws that let low-privileged attackers bypass security controls, perform unauthorized read/write operations, and in some cases achieve remote code execution, as well as input validation weaknesses enabling control bypass across different privilege levels.

Twelve CVEs are listed in total, with CVSS scores ranging from 4.3 to 10.0; eight of them score 8.0 or higher, indicating a dense cluster of high-impact flaws in a single release. The advisory does not report in-the-wild exploitation at this time, but given the severity (unauthenticated RCE via template injection) and the historical popularity of Adobe Commerce/Magento as a target for e-commerce attackers, rapid patching is strongly recommended. Defenders running Adobe Commerce should apply Adobe's security updates immediately and monitor for post-authentication anomalies, unusual template rendering behavior, and unexpected admin-level actions consistent with authorization bypass.

No threat actor, malware family, or active campaign is named in this advisory; it is a vendor patch bulletin relayed by the Dutch national CERT. Organizations using Adobe Commerce (and Magento-based storefronts) should treat this as a priority patching action given the number of critical/near-critical CVSS scores involved.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100133, CVE-2026-103849, CVE-2026-75650 (KEV), CVE-2026-91013, CVE-2026-92464, CVE-2026-92908, CVE-2026-92909, CVE-2026-92910, CVE-2026-92911, CVE-2026-92922, CVE-2026-95630, CVE-2026-95631

## Detection guidance (public sample)

### Web Server or PHP-FPM Process Spawning Shell With Recon or Download Commands

ATT&CK: T1190

Detects a web server or PHP worker spawning a Unix shell that runs download, reverse-shell or recon commands, typical of post-exploitation after RCE (e.g. template injection) in a PHP e-commerce application such as Adobe Commerce/Magento. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP-FPM Process Spawning Shell With Recon or Download Commands
description: Detects a web server or PHP worker (php-fpm, apache, nginx) spawning
  a Unix shell that runs download, reverse-shell or recon commands. This is typical
  post-exploitation behaviour after RCE in a PHP e-commerce application such as Adobe
  Commerce/Magento. The advisory names no in-the-wild exploitation, so the rule generalises
  on the web-process-to-shell-to-attacker-tooling pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - /apache2
    - /httpd
    - /nginx
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - base64 -d
    - nc -e
    - whoami
    - chmod +x /tmp
    - chmod 777 /tmp
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Deployment or health-check scripts invoked by PHP that legitimately call curl or
  wget through a shell
- Administrators running diagnostic commands through a web-based management panel
level: medium
id: e46796c8-9893-59ca-a13c-5df3d4dcffb6
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0436.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0436.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1a211364-1e1c-5505-ab32-6dc930f6d010/adobe-commerce-patches-critical-rce-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup