{"metadata": {"vulnerability": "CVE-2026-103849", "count": 39, "kinds": {"milestone": 8, "sighting": 12, "kev": 0, "other": 19}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T11:27:51.468Z", "date_only": false, "value": "2026-10-01T11:27:51.468Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T17:00:00Z", "date_only": false, "value": "2026-10-13T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-103849", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:15:53.468Z", "date_only": false, "value": "2026-10-13T18:15:53.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T18:15:53.468Z", "date_only": false, "value": "2026-10-13T18:15:53.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / adobe", "record": "CVE-2026-103849", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:35:01.725Z", "date_only": false, "value": "2026-10-13T18:35:01.725291Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117435039821304436", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "f4b05c89-b293-4bbf-abe3-8b58f9596c47", "content": "CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103849https://www.adobe.com/trust/security/products/commerce/apsb26-153.html#adobe #Adobe #AdobeCommerce #AdobeCommerceB2B #MagentoOpenSource#CVE_2026_103849#bot", "url": "https://infosec.exchange/users/cve/statuses/117435039821304436"}, {"timestamp": "2026-10-13T19:17:53Z", "date_only": false, "value": "2026-10-13T19:17:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:17:53.997Z", "date_only": false, "value": "2026-10-13T19:17:53.997", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "published"}, {"timestamp": "2026-10-13T19:33:22.125Z", "date_only": false, "value": "2026-10-13T19:33:22.125227Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxrrlldt3cco", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "ee0729a3-2cdc-40f8-9e1e-53622f43419e", "content": "CVE Radar | CVE-2026-103849 | CVSS 10.0\n\nCritical Adobe Commerce Template Engine Flaw\n\nCVE-2026-103849 is rated Critical with a CVSS 3.1 score of 10.0.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1257", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxrrlldt3cco"}, {"timestamp": "2026-10-13T19:48:53.130Z", "date_only": false, "value": "2026-10-13T19:48:53.130668Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxrshdjyfh2f", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "e32c1fe6-0e9d-46d2-993d-42b6280d1152", "content": "Adobe Commerce products face two critical flaws.\n\u2022 CVE-2026-103849 at CVSS 10\n\u2022 CVE-2026-100133 at 9.3\nMultiple versions across Commerce, B2B, and Magento Open Source require attention.\n\nhttps://thecircuitry.to/article/pair-of-severe-flaws-surface-in-adobe-commerce-products-mv734xbz", "url": "https://bsky.app/profile/thecircuitry.to/post/3mxrshdjyfh2f"}, {"timestamp": "2026-10-13T20:10:00.901Z", "date_only": false, "value": "2026-10-13T20:10:00.901406Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrtn5ambc2z", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "930da458-818f-4706-9795-be8b826ac35f", "content": "\ud83d\udea8 CVE-2026-103849 \u2014 CVSS 10 CRITICAL\n\nAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vuln...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-103849\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrtn5ambc2z"}, {"timestamp": "2026-10-13T21:33:03Z", "date_only": false, "value": "2026-10-13T21:33:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "published"}, {"timestamp": "2026-10-13T21:33:03Z", "date_only": false, "value": "2026-10-13T21:33:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R2JR-3WJ5-6696", "record": "GHSA-R2JR-3WJ5-6696", "field": "modified"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103849", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1301", "record": "CERTFR-2026-AVI-1301", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T02:30:04.576Z", "date_only": false, "value": "2026-10-14T02:30:04.576742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsiuqdmuh27", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "af569519-7e0e-4d17-945f-b0affdee6ccc", "content": "CVE-2026-103849 - adobe commerce\nAdobe Commerce, including the B2B edition and Magento Open Source, can be tricked into executing attacker\u2011controlled code without any user click. This could let a hacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#adobecommerce #adobe #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxsiuqdmuh27"}, {"timestamp": "2026-10-15T03:56:38.606Z", "date_only": false, "value": "2026-10-15T03:56:38.606Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103849", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T03:56:38.606Z", "date_only": false, "value": "2026-10-15T03:56:38.606Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103849", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T04:18:13.557Z", "date_only": false, "value": "2026-10-15T04:18:13.557", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103849", "record": "FKIE_CVE-2026-103849", "field": "lastModified"}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T05:45:57.851Z", "date_only": false, "value": "2026-10-16T05:45:57.851+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3944", "record": "WID-SEC-W-2026-3944", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-16T06:32:06.312Z", "date_only": false, "value": "2026-10-16T06:32:06.312063Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0436", "record": "NCSC-2026-0436", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T20:01:19.283Z", "date_only": false, "value": "2026-10-16T20:01:19.283306Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mxzekdvhqp2m", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "52e0ed91-a1ae-4cbb-898e-e7f167fb11d6", "content": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mxzekdvhqp2m"}, {"timestamp": "2026-10-16T20:45:37.964Z", "date_only": false, "value": "2026-10-16T20:45:37.964184Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxzgzllvwp2q", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "674c5278-de54-4dfe-bd66-98d8909da7b9", "content": "BlockStrap \u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001Magento \u30b5\u30fc\u30d0\u30fc\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\n\n\u7814\u7a76\u8005\u3089\u306f\u3001Magento \u3068 Adobe Commerce \u306b\u5f71\u97ff\u3059\u308b\u6700\u9ad8\u6df1\u523b\u5ea6\u306e\u8106\u5f31\u6027\uff08CVE-2026-103849\uff09\u304c\u8fd1\u304f\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u7a81\u304b\u308c\u308b\u3068\u3001\u30b9\u30c8\u30a2\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u4efb\u610f\u306e PHP \u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002 EC \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d\u306e Sansec \u306b\u3088\u308b\u3068\u3001\u300cB", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxzgzllvwp2q"}, {"timestamp": "2026-10-16T20:50:10.421Z", "date_only": false, "value": "2026-10-16T20:50:10.421580Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117452558145561836", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "2fcc78c6-40de-4ff4-bc6d-4c05a53c4bd1", "content": "Critical BlockStrap flaw lets hackers run code on Magento servers\nA maximum-severity vulnerability in Magento and Adobe Commerce (CVE-2026-103849, dubbed BlockStrap) could let attackers execute arbitrary PHP code on store servers, BleepingComputer reports. Security firm Sansec says no attacks have been observed yet, but warns that Adobe\u2019s \u2018priority 2\u2019 rating understates the risk. https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/", "url": "https://infosec.exchange/users/edwardk/statuses/117452558145561836"}, {"timestamp": "2026-10-16T20:50:11.058Z", "date_only": false, "value": "2026-10-16T20:50:11.058524Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxzhbpt55w2p", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "74f24d0f-477e-4cf2-a6cd-6f8bacdc884d", "content": "Critical BlockStrap flaw lets hackers run code on Magento servers\n\nA maximum-severity vulnerability in Magento and Adobe Commerce (CVE-2026-103849, dubbed BlockStrap) could let attackers execute arbitrary PHP code on sto... https://threatintel.cc/2026/10/16/critical-blockstrap-flaw-lets-hackers.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxzhbpt55w2p"}, {"timestamp": "2026-10-16T20:56:50.836Z", "date_only": false, "value": "2026-10-16T20:56:50.836177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxzhnmy4x62x", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "b1255f0c-54a4-40c4-8736-effeae438091", "content": "Magento/Adobe Commerce\u306bBlockStrap\u8106\u5f31\u6027(CVE-2026-103849)\u304c\u5b58\u5728\u3002\u30b9\u30c8\u30a2\u30b5\u30fc\u30d0\u30fc\u3067\u4efb\u610f\u306ePHP\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308b\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxzhnmy4x62x"}, {"timestamp": "2026-10-16T21:51:39.535Z", "date_only": false, "value": "2026-10-16T21:51:39.535431Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxzkpnmjdo2p", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "980f289c-00a4-4d3d-bc38-8f4471986f5f", "content": "\ud83e\udd16 CVE-2026-103849 (max severity): arbitrary PHP code execution in Magento / Adobe Commerce \u22642.4.9 (B2B \u22641.5.3). Sansec found 4 attack paths in under 24h.\nhttps://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxzkpnmjdo2p"}, {"timestamp": "2026-10-17T01:01:30.438Z", "date_only": false, "value": "2026-10-17T01:01:30.438042Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mxzvd4h6yq2a", "record": "CVE-2026-103849", "field": "creation_timestamp", "uuid": "a4156d6d-fd7f-4d3c-b995-25e593953ee9", "content": "BlockStrap \u306e\u91cd\u5927\u8106\u5f31\u6027\u3001Magento \u30b5\u30fc\u30d0\u30fc\u3078\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u8a31\u53ef\n\nMagento \u3068 Adobe Commerce \u306b\u5f71\u97ff\u3059\u308b\u6700\u9ad8\u6df1\u523b\u5ea6\u306e\u8106\u5f31\u6027 CVE-2026-103849 \u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u304c\u4efb\u610f\u306e PHP \u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u3001\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u8981\u3067\u3059\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "url": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mxzvd4h6yq2a"}]}