Adobe Commerce B2B Arbitrary Code Execution (APSB26-146)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344800);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2026-75650");

  script_name(english:"Adobe Commerce B2B Arbitrary Code Execution (APSB26-146)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Commerce B2B module installed on the remote host is missing a security hotfix.");
  script_set_attribute(attribute:"description", value:
"The version of the Adobe Commerce B2B module installed on the remote host is affected by a vulnerability as referenced
in the APSB26-146 advisory.

  - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine
    vulnerability that could result in arbitrary code execution in the context of the current user. An attacker
    could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user
    interaction. Scope is changed. (CVE-2026-75650)

Adobe resolved this issue with the VULN-39341 hotfix, which patches the underlying Adobe Commerce core rather than the
B2B module and does not change any reported version. Because the hotfix state cannot be confirmed from the B2B module
version alone, this plugin reports the module as potentially affected. The authoritative fix status for the host is
reported by the Adobe Commerce / Magento Open Source check.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/magento/apsb26-146.html");
  # https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?78a58ae4");
  script_set_attribute(attribute:"see_also", value:"https://sansec.io/research/stylesmuggler-0day");
  script_set_attribute(attribute:"solution", value:
"Apply the VULN-39341 hotfix as referenced in the vendor advisory, then rotate the encryption key and every credential
that may have been encrypted or exposed with it.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-75650");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:commerce_b2b");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_commerce_b2b_nix_installed.nbin", "adobe_commerce_nix_installed.nbin");
  script_require_keys("installed_sw/Adobe Commerce B2B", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# The VULN-39341 hotfix patches the Adobe Commerce core, not the B2B module, and leaves no marker on the B2B module
# record - so the fix cannot be confirmed from the module version. The check is gated behind paranoid reporting and
# reports the module as a potential finding; the core Adobe Commerce / Magento check gives the confirmed answer.
# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'check_algorithm': 'default',
      'product': {'name': 'Adobe Commerce B2B', 'type': 'app'},
      'potential_vulnerability': {
        'low_fidelity': {'context': 'core hotfix leaves no marker on the B2B module record'}
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '1.3.3.0', 'max_version': '1.3.4.999', 'fixed_display': 'Apply hotfix VULN-39341'},
        {'min_version': '1.4.2.0', 'max_version': '1.4.2.999', 'fixed_display': 'Apply hotfix VULN-39341'},
        {'min_version': '1.5.2.0', 'max_version': '1.5.3.999', 'fixed_display': 'Apply hotfix VULN-39341'}
      ]
    }
  ]
};

var vdf_res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_res);