AI analysis
Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking.
Estimated exposure
largeOn the order of 100,000 storefronts (vulnerable subset unknown) — Public web-technology surveys have long counted Magento/Adobe Commerce storefronts in the tens to low hundreds of thousands; the share actually running a vulnerable build cannot be determined because no version range was provided.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.