Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Magento Enterprise Edition may allow remote code execution

CVE-2026-103849 · published today
Summary

The Magento Enterprise Edition and related Adobe Commerce products contain a security hole that could let a hacker run their own programs on your server, potentially exposing data or disrupting the site. This flaw has been repaired in the latest releases. Update the affected software to the newest version right away.

What to do
  • Update magento magento/product-enterprise-edition to version 2.4.7-p1012007004+root.io.
  • Update magento magento/product-enterprise-edition to version 2.4.7-p1012007005+root.io.
  • Update magento magento/product-community-edition to version 2.4.7-p1012007004+root.io.
  • Update magento magento/product-community-edition to version 2.4.8-p512007004+root.io.
Affected software
Ecosystem VendorProductAffected versions
– adobe adobe commerce <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
– adobe adobe commerce b2b <= 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
– adobe magento open source <= 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
Root:Composer magento magento/product-enterprise-edition < 2.4.7-p1012007004+root.io
< 2.4.7-p1012007005+root.io
Fix: upgrade to 2.4.7-p1012007004+root.io
Root:Composer magento magento/product-community-edition < 2.4.7-p1012007004+root.io
< 2.4.8-p512007004+root.io
Fix: upgrade to 2.4.7-p1012007004+root.io
Original advisory text
CVE-2026-103849 in magento/product-enterprise-edition - Patched by Root
Root has patched CVE-2026-103849 in the magento/product-enterprise-edition package for Root:Composer. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-103849 · NVD
CVE-2026-103849 · MITRE
ROOT-APP-COMPOSER-CVE-2026-103849 · OSV
Track software like this
Free during beta