Story · 3 sources · 4 articlesfirst Oct 14, 15:44 UTCupdated Oct 15, 05:00 UTC (1d ago)

Adobe flaws span critical Magento RCE and Photoshop overflows

highVulnerabilityimportance 78CVE-2026-103849 CVE-2026-75650 CVE-2025-54236 CVE-2026-95636 CVE-2026-83661

What's new: ZDI added two Photoshop remote-code-execution advisories not in the prior summary: ZDI-26-778 (CVE-2026-95636) in DCM pixel-data parsing and ZDI-26-777 (CVE-2026-83661) in AdobePDFL PDF JPEG parsing, both CVSS 7.8 and requiring a user to open a malicious file or page, with no exploitation reported. Canada’s multi-product advisory and Sansec’s Blockstrap coverage were already summarized.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Canada urged broad Adobe updates while Sansec detailed critical Magento RCE CVE-2026-103849 and ZDI disclosed two Photoshop integer-overflow code-execution bugs.

On October 14, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1039 covering vulnerabilities in numerous Adobe products as of October 13, including Bridge, ColdFusion 2025 and 2023, Commerce and Commerce B2B, Experience Manager, FrameMaker, Photoshop, Substance 3D applications, and Magento Open Source. The centre did not cite CVE identifiers or active exploitation and told administrators to review Adobe’s security bulletins and apply necessary updates. Sansec identified Blockstrap as unauthenticated template-injection remote code execution in Adobe Commerce and Magento Open Source email templates, tracked as CVE-2026-103849 with CVSS 10.0 and addressed in Adobe bulletin APSB26-153, published October 13, for Commerce and Magento through 2.4.9 and Commerce B2B through 1.5.3. Sansec said it reproduced four code-execution routes within 24 hours but has not observed attacks on live stores; Adobe rated the issue priority 2, while Sansec urged patching within hours, and said the flaw is separate from StyleSmuggler (CVE-2026-75650), so both the October patch and the September hotfix must remain in place. Separately, the Zero Day Initiative published ZDI-26-778 and ZDI-26-777, integer overflows in Photoshop’s DCM pixel-data parser (CVE-2026-95636) and AdobePDFL PDF JPEG parser (CVE-2026-83661), each scored CVSS 7.8, that can allow remote code execution if a user opens a malicious file or visits a malicious page, with no active exploitation reported. The sources differ in scope rather than contradicting one another: the Cyber Centre gives a broad multi-product notice without CVEs, Sansec supplies Commerce and Magento identifiers, scores, version ceilings, and reproduction status, and ZDI details two user-interaction Photoshop flaws.

On October 14, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1039 on Adobe product vulnerabilities as of October 13, without naming CVEs or active exploitation, and urged administrators to review Adobe bulletins and…
Cyber Centre-listed products include Adobe Bridge, ColdFusion 2025 and 2023, Commerce and Commerce B2B, Experience Manager, FrameMaker, Photoshop, Substance 3D applications, and Magento Open Source.
Sansec described Blockstrap, unauthenticated template-injection RCE CVE-2026-103849 (CVSS 10.0) in Adobe Commerce and Magento Open Source email templates, fixed in APSB26-153 on October 13 for Commerce and Magento through 2.4.9 and…
Sansec reproduced four code-execution routes within 24 hours but has not seen live-store attacks; Adobe rated the issue priority 2 while Sansec urged patching within hours, and said the September StyleSmuggler hotfix for CVE-2026-75650…

VendorsAdobe

ProductsAdobe Commerce Magento Open Source Adobe Commerce B2B Adobe Photoshop AdobePDFL Adobe Bridge Adobe ColdFusion Adobe Experience Manager Adobe FrameMaker Adobe Substance 3D

OrganizationsSansec Adobe Trend Micro Zero Day Initiative Zero Day Initiative Canadian Centre for Cyber Security

CountriesCanada

Coverage timelineoldest first · each row is one article

Oct 14, 15:44 UTC · 2d ago
Canadian Centre for Cyber Security· 38
Adobe security advisory (AV26-1039)
Canada’s Cyber Centre urges updates for vulnerabilities across many Adobe products, including ColdFusion and Commerce.
Oct 15, 00:00 UTC · 2d ago
Sansec (Magento / e-commerce security)· 78
Blockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Sansec warns of unauthenticated Magento and Adobe Commerce RCE CVE-2026-103849, with no live exploitation seen yet.
Oct 15, 05:00 UTC · 1d ago
ZDI Published Advisories· 46
ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability

Vulnerabilities in this storyAll →

CVE-2025-542369.195%
Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
published Sep 9, 2025· Adobe Commerce KEV PoC ×2
CVE-2026-103849

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-54236	Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) Adobe Commerce and Magento Open Source contain an improper input validation flaw (CWE-20), widely tracked as 'SessionReaper', that lets a remote, unauthenticated attacker take over user sessions. The flaw is exploitable over the network with no privileges and no user interaction (CVSS 3.1 9.1, critical). A successful attacker hijacks legitimate customer or admin sessions, yielding high confidentiality and integrity impact; a public writeup additionally describes unauthenticated exploitation potentially reaching code execution. Anyone running Adobe Commerce (including Commerce B2B) or Magento Open Source on the affected 2.4.x releases is exposed. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2025-10-24, reporting headlines cite over 250 observed attacks, EPSS is 94.5%, and roughly 3 in 5 stores were reported as still unpatched. Do: Immediately upgrade every affected 2.4.x line to a release newer than 2.4.9-alpha2/2.4.8-p2/2.4.7-p7/2.4.6-p12/2.4.5-p14/2.4.4-p15 per Adobe's security advisory. Because the flaw is on CISA's KEV list, federal agencies must apply the vendor's mitigations (or BOD 22-01 cloud guidance) or discontinue use; other defenders should prioritize patching given 250+ observed attacks and 94.5% EPSS. Until patched, watch for indicators of session takeover — unexpected customer or admin sessions, unfamiliar admin accounts, and anomalous session activity — and review Adobe's advisory for interim mitigations.	9.1	95%	KEV PoC ×2	Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier (all listed 2.4.x lines and older releases) Adobe Commerce B2B Listed via CPE as affected alongside Adobe Commerce; no separate version range given in the source data — treat B2B deployments on the affected Commerce 2.4.x l Adobe Magento Open Source (Magento) 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier	mass≈100,000+ internet-facing Adobe Commerce/Magento storefronts (order of magnitude 10^5)	Sep 9, 2025 KEV Oct 24, 2025
CVE-2026-103849	Unauthenticated template-injection RCE in Adobe Commerce Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking.	10.0	—		Adobe Commerce	largeOn the order of 100,000 storefronts (vulnerable subset unknown)	3d ago
CVE-2026-75650	Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08. Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.	10.0	4%	KEV PoC
CVE-2026-83661 +1 related CVE CVE-2026-95636	Integer overflow in Adobe Photoshop Desktop allows code execution Adobe Photoshop Desktop is affected by an integer overflow or wraparound (CWE-190) that can lead to arbitrary code execution in the context of the current user. The flaw is triggered only when a victim opens a malicious file, so it is a local, user-interaction attack rather than a remote unauthenticated one. A successful attacker gains high impact on confidentiality, integrity, and availability of that user's session (CVSS 3.1 base score 7.8). Anyone running an affected Photoshop Desktop build who opens untrusted files is at risk; specific version ranges were not included in the source data. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Install the Adobe security update for Photoshop Desktop as soon as it is published for your release, and do not open image or project files from untrusted sources until you are patched. Until then, treat unexpected Photoshop files as untrusted and prefer opening them only in a restricted or non-production account.	7.8	—		Adobe Photoshop Desktop	massOn the order of millions of desktop installations (likely well above 1 million users)	3d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-54236

Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)

Adobe Commerce and Magento Open Source contain an improper input validation flaw (CWE-20), widely tracked as 'SessionReaper', that lets a remote, unauthenticated attacker take over user sessions. The flaw is exploitable over the network with no privileges and no user interaction (CVSS 3.1 9.1, critical). A successful attacker hijacks legitimate customer or admin sessions, yielding high confidentiality and integrity impact; a public writeup additionally describes unauthenticated exploitation potentially reaching code execution. Anyone running Adobe Commerce (including Commerce B2B) or Magento Open Source on the affected 2.4.x releases is exposed. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2025-10-24, reporting headlines cite over 250 observed attacks, EPSS is 94.5%, and roughly 3 in 5 stores were reported as still unpatched.

Do: Immediately upgrade every affected 2.4.x line to a release newer than 2.4.9-alpha2/2.4.8-p2/2.4.7-p7/2.4.6-p12/2.4.5-p14/2.4.4-p15 per Adobe's security advisory. Because the flaw is on CISA's KEV list, federal agencies must apply the vendor's mitigations (or BOD 22-01 cloud guidance) or discontinue use; other defenders should prioritize patching given 250+ observed attacks and 94.5% EPSS. Until patched, watch for indicators of session takeover — unexpected customer or admin sessions, unfamiliar admin accounts, and anomalous session activity — and review Adobe's advisory for interim mitigations.

9.1

95%

KEV PoC ×2

Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier (all listed 2.4.x lines and older releases)
Adobe Commerce B2B Listed via CPE as affected alongside Adobe Commerce; no separate version range given in the source data — treat B2B deployments on the affected Commerce 2.4.x l
Adobe Magento Open Source (Magento) 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier

mass≈100,000+ internet-facing Adobe Commerce/Magento storefronts (order of magnitude 10^5)

Sep 9, 2025

KEV Oct 24, 2025

CVE-2026-103849

Unauthenticated template-injection RCE in Adobe Commerce

Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking.

10.0

—

Adobe Commerce

largeOn the order of 100,000 storefronts (vulnerable subset unknown)

3d ago

CVE-2026-75650

Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)

Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.

Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.

10.0

KEV PoC

CVE-2026-83661

+1 related CVE

CVE-2026-95636

Integer overflow in Adobe Photoshop Desktop allows code execution

Adobe Photoshop Desktop is affected by an integer overflow or wraparound (CWE-190) that can lead to arbitrary code execution in the context of the current user. The flaw is triggered only when a victim opens a malicious file, so it is a local, user-interaction attack rather than a remote unauthenticated one. A successful attacker gains high impact on confidentiality, integrity, and availability of that user's session (CVSS 3.1 base score 7.8). Anyone running an affected Photoshop Desktop build who opens untrusted files is at risk; specific version ranges were not included in the source data. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Install the Adobe security update for Photoshop Desktop as soon as it is published for your release, and do not open image or project files from untrusted sources until you are patched. Until then, treat unexpected Photoshop files as untrusted and prefer opening them only in a restricted or non-production account.

7.8

—

Adobe Photoshop Desktop

massOn the order of millions of desktop installations (likely well above 1 million users)

3d ago