Sansec warns Magento flaw could let attackers run PHP on store servers

The issue spans recent Adobe Commerce, Magento Open Source and B2B releases, and Sansec says admins need Adobe’s October fix plus the earlier hotfix.

Researchers at Sansec say a newly disclosed maximum-severity Magento and Adobe Commerce flaw, CVE-2026-103849, could let attackers run arbitrary PHP on store servers, even though no exploitation has been seen yet. Adobe published its bulletin on October 13 and rates the issue as priority 2, but Sansec argues the risk is higher because it found four possible attack paths in under 24 hours and expects working exploits soon. The flaw affects September releases of Adobe Commerce and Magento Open Source through 2.4.9, plus Adobe Commerce B2B through 1.5.3. Sansec says Adobe’s fix changes the generic template handling to registered placeholders, and administrators should apply the 2026-oct release or Adobe’s isolated patch rather than relying on a plain Composer install. The company also warns that the earlier September VULN-39341 hotfix still needs to remain in place because BlockStrap and StyleSmuggler are separate fixes.