Vulnerability

CVE-2026-103849

1 story · 1 outlet

Impacted if

Not known yet — the vendor's record and the NVD are being read.

First seen by AX-NEWS 16 Oct 2026, 20:00 UTC · latest story 16 Oct 2026, 20:00 UTC. Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

Critical BlockStrap flaw lets hackers run code on Magento servers
BleepingComputer 16 Oct 2026, 20:00 UTC Cybersecurity

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]