Critical BlockStrap flaw (CVE-2026-103849) in Magento and Adobe Commerce enables PHP code execution; exploitation expected
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation soon. Sansec disputes Adobe's "priority 2" rating (patch within 30 days), noting that the earlier StyleSmuggler flaw went from a priority 1 hotfix to mass exploitation in three days and that BlockStrap is of similar complexity. Adobe published its bulletin on October 13.
Technical Details
- Adobe describes the flaw as improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
- Sansec describes BlockStrap as a second-pass template engine directive injection: attacker-controlled content in a child email template is signed and then processed again at the root level, executing a smuggled
{{block}}directive. - It exposes a gap left by the StyleSmuggler fix in the same email-template engine.
- Affected: September versions of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3.
- Sansec notes that the attack path is complex, but that AI agents can reverse-engineer the patch into working exploits quickly.
Remediation
- Apply the 2026-oct release or Adobe's isolated patch. A plain Composer install is not sufficient.
- Keep the September VULN-39341 hotfix (StyleSmuggler) in place, since the two fixes are separate and both are required.
- Treat patching as urgent rather than waiting for the 30-day window implied by Adobe's priority 2 rating.
Linha do tempo
-
Critical BlockStrap flaw (CVE-2026-103849) in Magento and Adobe Commerce enables PHP code execution; exploitation expected
ler a análise desta fonte ocultar
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation soon. Sansec disputes Adobe's "priority 2" rating (patch within 30 days), noting that the earlier StyleSmuggler flaw went from a priority 1 hotfix to mass exploitation in three days and that BlockStrap is of similar complexity. Adobe published its bulletin on October 13.
Technical Details
- Adobe describes the flaw as improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
- Sansec describes BlockStrap as a second-pass template engine directive injection: attacker-controlled content in a child email template is signed and then processed again at the root level, executing a smuggled
{{block}}directive. - It exposes a gap left by the StyleSmuggler fix in the same email-template engine.
- Affected: September versions of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3.
- Sansec notes that the attack path is complex, but that AI agents can reverse-engineer the patch into working exploits quickly.
Remediation
- Apply the 2026-oct release or Adobe's isolated patch. A plain Composer install is not sufficient.
- Keep the September VULN-39341 hotfix (StyleSmuggler) in place, since the two fixes are separate and both are required.
- Treat patching as urgent rather than waiting for the 30-day window implied by Adobe's priority 2 rating.