Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Life Of This Page

1. 1
   Born
   Nov 04 04:51 UTC
   A second, independent source names it.
2. 2
   Developing
   Nov 04 04:51 UTC
   New signals join; severity can move.
3. 3
   Confirmed · Now
   Nov 04 04:51 UTC
   CISA KEV lists it, or exploitation in the wild is reported.
4. 4
   Resolved
   Not yet
   Past the fix deadline and 14 days with no new signal.
5. 5
   Archived
   Not yet
   30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

1. Disclosed: reached
   Nov 03 14:09 UTC
   C56 first to name it
2. Scored: reached
   Nov 03 14:09 UTC
   No CVSS yet · EPSS 3.9%
3. Exploited: reached
   Nov 04 04:51 UTC
   C1 CISA KEV, fix by 2026-09-11
4. Advisories: not yet
   Not yet
   None yet
5. Vendor Response: not yet
   Not yet
   None in sources yet
6. Resolved: not yet
   Not yet
   When fixed: KEV deadline 2026-09-11, then 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.