Adobe Commerce is vulnerable to an improper neutralization of special elements used in its template engine. This flaw allows an attacker to inject malicious templates that are executed with the privileges of the current user. The consequence is arbitrary code execution, which can lead to elevated access or complete takeover of the victim’s account or session. The vulnerability’s scope is changed, meaning that compromise can affect an entire system rather than a single user. Exploitation does not require any user interaction, making it a purely remote attack vector.

The affected products are Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. No specific version information is disclosed in the available data, so all releases of these products should be considered at risk if they have not applied the vendor’s fix.

The CVSS score of 10 indicates a critical severity. With no EPSS score available, the known exploitation probability cannot be quantified, but the fact that no user interaction is required suggests a high likelihood of remote exploitation. The vulnerability is not listed in the CISA KEV catalog, yet the impact and scope make it a pressing concern for administrators. Attackers can reach the vulnerable system via exposed web interfaces and immediately inject malicious template code, achieving full code execution in the context of the application.