Critical 'BlockStrap' flaw puts Magento servers at risk of remote code execution

Maximum-severity vulnerability in Adobe Commerce and Magento Open Source could be exploited by AI-assisted attackers, researchers warn

By LineZotpaper

Published17 October 2026

Read Time2 min

A maximum-severity vulnerability, tracked as CVE-2026-103849 and dubbed BlockStrap, has been discovered in Adobe Commerce and Magento Open Source, potentially allowing attackers to execute arbitrary PHP code on store servers. E-commerce security firm Sansec says no attacks have been observed yet, but it expects mass exploitation to occur soon.

The flaw resides in a second-pass template engine directive injection, enabling attacker-controlled content in a child email template to be processed again at the root level, executing a smuggled {{block}} directive. Adobe published a bulletin on October 13 describing the issue as an improper neutralization of special elements used in a template engine.

The vulnerability affects September versions of Adobe Commerce and Magento Open Source through version 2.4.9, and Adobe Commerce B2B through version 1.5.3.

Sansec warns that Adobe's "priority 2" rating (patch within 30 days) does not reflect the danger. "The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," the security firm stated. "That is why we question Adobe's priority 2 rating. StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity."

StyleSmuggler was a previous zero-day in the same email-template engine that was exploited in the wild to backdoor servers. Sansec says BlockStrap exposes a gap left by that earlier fix. Adobe's latest patch replaces generic processing with registered placeholders.

Website administrators must apply the 2026-oct release or Adobe's isolated patch. Sansec cautions that a plain Composer install is insufficient, and the September VULN-39341 hotfix for StyleSmuggler must also be kept in place, as the two fixes address separate vulnerabilities.

The security firm says it will provide an update when it detects mass attack waves, which it expects to occur soon.

Analysis

Why This Matters

E-commerce sites running unpatched versions are exposed to full server compromise, threatening customer data and store operations.
The speed at which similar flaws like StyleSmuggler moved from disclosure to mass exploitation sets a worrying precedent.
Administrators face a narrow window to apply both the new BlockStrap patch and retain the earlier StyleSmuggler fix.

Background

BlockStrap is the second critical vulnerability found in Adobe Commerce's email-template engine in recent months. The prior flaw, StyleSmuggler, was exploited in the wild within days of a hotfix release. Sansec, a security firm specializing in e-commerce platforms, identified four potential attack paths for BlockStrap within 24 hours of disclosure, raising concerns that automated exploit development will accelerate attacks.

Key Perspectives

Sansec (e-commerce security researchers): Urge immediate patching despite Adobe's lower severity rating, citing the ease with which AI can reverse-engineer fixes into exploits. They are monitoring for mass attack waves. Adobe: Assigned a priority 2 rating to the flaw, which recommends patching within 30 days. Adobe's bulletin describes the vulnerability but does not explicitly address the disparity in risk assessment. Merchants and site administrators: Must apply the October 2026 release and retain the September hotfix for StyleSmuggler, ensuring both patches are active to close the email-template engine vulnerabilities.

What to Watch

Sansec's next update confirming or denying the start of mass exploitation attempts.
Whether Adobe revises its priority rating for CVE-2026-103849 as more information emerges.
Security monitoring reports from e-commerce platforms tracking unexpected code execution attempts.

Sources

Critical BlockStrap flaw lets hackers run code on Magento servers — BleepingComputer