Critical BlockStrap flaw lets hackers run code on Magento servers
Sansec warns CVE-2026-103849 can run arbitrary PHP on unpatched Magento and Adobe Commerce servers.
Sansec warns that CVE-2026-103849, dubbed BlockStrap, can let attackers execute arbitrary PHP on Magento and Adobe Commerce servers through a second-pass email-template injection. It affects September releases of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. Sansec found four potential attack paths in under 24 hours but says exploitation has not been observed. Adobe rated it priority 2; Sansec says stores must apply the October 2026 release or isolated patch and retain the separate StyleSmuggler hotfix.
- CVE-2026-103849 allows arbitrary PHP execution via email-template injection.
- Impacts Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
- Sansec has not seen attacks but expects exploitation soon.
- Install the October 2026 release or isolated patch and keep the StyleSmuggler hotfix.
Vulnerabilities mentionedAll →
- CVE-2026-10384910.0—Unauthenticated template-injection RCE in Adobe Commercepublished · Adobe Commerce
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-103849 | Unauthenticated template-injection RCE in Adobe Commerce Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known. Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking. |
Full article392 words · extracted from bleepingcomputer.com · click to collapse
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit it.
The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours.
The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
The security firm warned that Adobe’s “priority 2” rating of this flaw does not reflect the danger and urgency in this case, despite the more complex attack path.
“The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time,” stated Sansec states.
“That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.”
Adobe’s bulletin, published on October 13, describes the flaw as an improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
Sansec explains that BlockStrap is a second-pass template engine directive injection that allows attacker-controlled content in a child email template to be signed and processed again at the root level, executing a smuggled {{block}} directive.
According to Sansec’s analysis, BlockStrap exposes a gap left by the StyleSmuggler fix in the same email-template engine.
Adobe’s fix replaces the generic processing with registered placeholders, preventing exploitation.
Sansec says that a plain Composer install isn’t enough to address the risk, and website administrators must apply the 2026-oct release or Adobe’s isolated patch.
“BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well,” Sansec cautions.
The e-commerce security company says it will provide an update when it detects mass attack waves, which it expects to occur soon.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.