Adobe Commerce Template Injection Requires More Than a Routine Patch Adobe's APSB26-153 bulletin, published October 13, 2026, fixes critical vulnerabilities in Adobe Commerce and Magento Open Source. CVE-2026-103849 is an improper neutralization issue in a template engine with arbitrary code execution impact. Adobe assigns it a CVSS 3.1 base score of 10.0 and says no authentication is required. The bulletin also lists CVE-2026-92909, a B2B authorization issue rated 9.8, and stored cross-site scripting issues that can lead to privilege escalation. The common thread is application authority. Commerce deployments combine themes, extensions, integrations, and administrative workflows, so a code-execution flaw can cross from a storefront request into payment and order data. Affected release lines The affected Adobe Commerce, Adobe Commerce B2B, and Magento Open Source versions were those at the September 2026 patch level or earlier, depending on the release line. Adobe lists October 2026 isolated patches for the supported 2.4.x lines and B2B 1.x lines. The bulletin also says the hotfix for CVE-2026-75650 must be applied separately. That is an important operational detail. Installing the October security patch does not automatically close every item mentioned in the broader bulletin. Why template trust is sensitive Template engines are designed to evaluate expressions and render output. If untrusted input reaches a template evaluation path with the wrong context, the application may treat data as code. Commerce installations often add themes and extensions that are not maintained by the core product team. Review custom themes, modules, email templates, CMS blocks, and page-builder content. Identify which components accept administrator-controlled templates and which accept merchant or third-party input. Do not assume that a WAF rule against obvious template syntax covers encoded or context-dependent payloads. Patch sequence Start with a verified backup and a staging deployment. Apply the correct October isolated patch for each Commerce and B2B version, then apply the separate CVE-2026-75650 hotfix if the deployment is in scope. Run the storefront, checkout, payment, search, and admin workflows before production rollout. After deployment, clear generated code and caches according to the vendor's instructions. Confirm the production build uses the patched files and not an old opcode cache or container image. Record the patch identifiers and the verification evidence in the change ticket. Reduce template and integration authority Limit who can edit themes, email templates, CMS content, and extension configuration. Separate content editors from users who can deploy code. Review integrations and service accounts for permissions beyond their business function. Rotate credentials that could be exposed through the admin application, including payment, ERP, shipping, and search integrations. A code-execution flaw can reach environment variables and local configuration files, so credential rotation may be necessary even when there is no obvious suspicious order. Monitoring Review web server and Commerce logs for template-like expressions in unexpected parameters, new administrator accounts, module changes, and outbound connections to unfamiliar hosts. Correlate admin logins with deployment events and file changes. The patch is necessary. It is more effective when the storefront has a short list of trusted template authors and a tested process for future isolated patches. References Adobe Commerce security bulletin APSB26-153