Critical BlockStrap flaw lets hackers run code on Magento servers
Sansec warns CVE-2026-103849 can run arbitrary PHP on unpatched Magento and Adobe Commerce servers.
66
Product
Magento Open Source
- Mentions · 7d0
- Mentions · 30d3
- All mentions15
- First seenAug 13, 2026
- Last mentioned14d ago
Timeline
15 articles · newest firstBlockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Sansec warns of unauthenticated Magento and Adobe Commerce RCE CVE-2026-103849, with no live exploitation seen yet.
78
Adobe security advisory (AV26-1039)
Canada’s Cyber Centre urges updates for vulnerabilities across many Adobe products, including ColdFusion and Commerce.
38
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
82
Adobe security advisory (AV26-808) – Update 1
Canada's Cyber Centre updated Adobe advisory AV26-808 to flag that CVE-2026-71362 in Adobe Commerce is being exploited in the wild.
55
U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.
80
Adobe security advisory (AV26-888)
Canada's Cyber Centre warns CVE-2026-75650 in Adobe Commerce and Magento Open Source is exploited in the wild; hotfixes and updates are available.
68
StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day
Critical unauthenticated RCE zero-day CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento is actively exploited; Adobe shipped hotfix VULN-39341 on September 7.
88
Adobe Commerce max-severity bug comes under active attack
Attackers are actively exploiting CVE-2026-75650 (CVSS 10.0), an unauthenticated RCE zero-day in Adobe Commerce/Magento, deploying a Rust backdoor on e-commerce servers.
92
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
85
StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited
Attackers are actively exploiting an unpatched zero-day dubbed StyleSmuggler in Magento Open Source and Adobe Commerce for unauthenticated remote code execution.
82
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
85
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.
88
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.
75
Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure
Attackers began exploiting critical Adobe Commerce flaw CVE-2026-71362 (CVSS 9.1) for unauthenticated customer account takeover shortly after patch release.
74
Related CVEs
by mentions- CVE-2026-756504%10.0Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2025-5423695%9.1Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
- CVE-2026-1038491%10.0Unauthenticated template-injection RCE in Adobe Commerce
- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-482732%9.9Eval Injection RCE in Adobe ColdFusion (CVSS 9.9, low-privileged attacker)
- CVE-2026-48381<1%9.0Unauthenticated SQL Injection Leading to RCE in Adobe Campaign Classic
- CVE-2026-7565<1%4.9The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and…
Appears with
- Adobevendor · 15
- Adobe Commerceproduct · 15
- Sansecvendor · 8
- Sansecorganization · 8
- Adobeorganization · 5
- Adobe Commerce B2Bproduct · 4
- StyleSmugglermalware · 4
- CISAorganization · 2
- Adobe Campaign Classicproduct · 2
- Canadian Centre for Cyber Securityorganization · 2
- Magentovendor · 2
- Adobe ColdFusionproduct · 2
- CISAvendor · 2
- StyleSmuggler implantmalware · 1
- Adobe Photoshopproduct · 1
- Disrex Groupvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.