{"id":12000,"date":"2026-09-08T15:04:19","date_gmt":"2026-09-08T21:04:19","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-98-critical-zero-day-in-adobe-commerce-and-magento-open-source\/"},"modified":"2026-09-29T13:01:20","modified_gmt":"2026-09-29T19:01:20","slug":"alert-2026-98-critical-zero-day-in-adobe-commerce-and-magento-open-source","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-98-critical-zero-day-in-adobe-commerce-and-magento-open-source\/","title":{"rendered":"Alert 2026-98 Critical Zero-Day in Adobe Commerce and Magento Open Source"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fix<\/strong><\/td><\/tr>
Adobe Commerce<\/strong><\/td>2.4.4\u20112026\u2011aug, 2.4.5\u20112026\u2011aug, 2.4.6\u20112026\u2011aug, 2.4.7\u20112026\u2011aug, 2.4.8\u20112026\u2011aug, 2.4.9\u20112026\u2011aug and earlier<\/td>Apply VULN\u201139341 hotfix corresponding to the installed version<\/td><\/tr>
Adobe Commerce B2B<\/strong><\/td>1.3.3\u20112026\u2011aug, 1.3.4\u20112026\u2011aug, 1.4.2\u20112026\u2011aug, 1.5.2\u20112026\u2011aug, 1.5.3\u20112026\u2011aug and earlier<\/td>Apply VULN\u201139341 hotfix corresponding to the installed version<\/td><\/tr>
Magento Open Source<\/strong><\/td>2.4.6\u20112026\u2011aug, 2.4.7\u20112026\u2011aug, 2.4.8\u20112026\u2011aug, 2.4.9\u20112026\u2011aug and earlier<\/td>Apply VULN\u201139341 hotfix corresponding to the installed version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Adobe officially tested the hotfix on the listed 2026-aug versions. Earlier versions within the affected branches are also vulnerable, but Adobe warns that the patch has not been officially validated on all of those legacy releases; in those cases, it is recommended to first upgrade to a supported version and apply the corresponding hotfix.<\/p>\n\n

Description<\/h2>\n\n

Adobe released an emergency update to fix CVE\u20112026\u201175650<\/strong>, a vulnerability of critical<\/strong> severity with a CVSS 10.0<\/strong> score that allows a remote unauthenticated<\/strong> attacker to execute arbitrary code on vulnerable Adobe Commerce and Magento Open Source installations.<\/p>\n\n

The CVE\u20112026\u201175650<\/strong> vulnerability affects the template rendering system of Magento\/Adobe Commerce and allows a Server-Side Template Injection (SSTI)<\/strong> chain that can result in remote code execution without requiring authentication. The vulnerability is an improper neutralization of special elements used in a template engine<\/strong>, classified as CWE\u20111336<\/strong><\/p>\n\n

Sansec’s research indicates that the attacker abuses a property called styles within the template mechanism. Through a specially crafted input, they can induce the dependency injection<\/em> system and template processing to instantiate unexpected classes and execute PHP code on the server.<\/p>\n\n

The observed malicious flow uses the creation of an email titled “Payment Transaction Failed Reminder”<\/strong> as a vehicle to trigger PHP code injection and cause execution on the server. The unauthenticated access and the ability to execute code make the impact maximum: an attacker can install persistence mechanisms, webshells, malware, steal configuration secrets, access databases, and modify e-commerce logic or payment processes.<\/p>\n\n

Solution<\/h2>\n\n

The official solution consists of applying the Adobe hotfix VULN\u201139341<\/strong>, published in bulletin APSB26\u2011146<\/strong>, for the specific version of Adobe Commerce, Adobe Commerce B2B, or Magento Open Source deployed. The hotfix fixes the unsafe handling of template values before unintended classes can be instantiated by the rendering engine.<\/p>\n\n

https:\/\/experienceleague.adobe.com\/en\/docs\/commerce-knowledge-base\/kb\/announcements\/commerce-apsb26-146<\/a><\/p>\n\n

Additional information:<\/h2>\n\n