---
title: Adobe October patches: CVSS 10.0 bugs in ColdFusion (CVE-2026-105899) and Commerce/Magento (CVE-2026-103849) | ctxsec
url: https://ctxsec.com/items/adobe-oct-2026
description: ""
status: "confirmed (vendor), not exploited"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/adobe-oct-2026.md)

confirmed (vendor), not exploited

2026-10-13

### Adobe October patches: CVSS 10.0 bugs in ColdFusion (CVE-2026-105899) and Commerce/Magento (CVE-2026-103849)

**ColdFusion (APSB26-144):** unauthenticated unrestricted file upload leading to code execution, CVE-2026-105899 (CVSS 10.0), plus SSRF CVE-2026-106622 (10.0) and several 9.x code-execution bugs. Fixed in ColdFusion 2025.0.14 and 2023.0.26. **Commerce / Magento Open Source (APSB26-153):** template-engine injection CVE-2026-103849 (10.0, no authentication) and B2B authorization bug CVE-2026-92909 (9.8). Install the 2026-oct builds and keep the Sept hotfix for CVE-2026-75650 (APSB26-146). Adobe says it is not aware of exploits in the wild for either bulletin (both priority 2), but both products have been on CISA KEV before, so patch internet-facing instances early. **Update Oct 16:** Sansec named the Commerce bug "BlockStrap", built four working exploit routes in a day, and warns a plain Composer install doesn't apply the fix (see separate item).

Sources: [Adobe APSB26-144 (ColdFusion)](https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html) · [Adobe APSB26-153 (Commerce)](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) · [@SecurityWeek](https://x.com/SecurityWeek/status/2110196392899572198) · [Sansec: BlockStrap](https://sansec.io/research/blockstrap-magento-rce)