Critical BlockStrap flaw in Magento lets attackers run code on store servers

A maximum-severity vulnerability dubbed BlockStrap, tracked as CVE-2026-103849, could let attackers execute arbitrary PHP code on servers running Adobe Commerce and Magento Open Source, BleepingComputer reported on October 16, citing e-commerce security firm Sansec. Adobe patched the flaw in bulletin APSB26-153 on October 13, but Sansec warns that the vendor's "priority 2" rating understates how quickly attackers could weaponize it against online stores.

What happened

According to BleepingComputer, Sansec identified four potential attack paths for the flaw in under 24 hours after the patch appeared. No exploitation has been observed so far, but Sansec expects attacks and said it will publish an update if it detects mass attack waves. The firm pointed to StyleSmuggler, a previous Magento zero-day in the same engine that went from a priority 1 hotfix to mass exploitation in three days.

Sansec also argued that "anyone with an AI agent can reverse-engineer the patch into working exploits" in a relatively short time, according to the report.

Technical details

Adobe's bulletin describes the bug as improper neutralization of special elements in a template engine. BleepingComputer said BlockStrap is a second-pass template directive injection in Magento's email template engine: attacker-controlled content in a child email template is signed and processed again at the root level, where a smuggled {{block}} directive is executed. The issue exploits a gap left by the earlier StyleSmuggler fix. Adobe's fix replaces generic processing with registered placeholders.

Who is affected

The flaw affects the September releases of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3, according to BleepingComputer. The report does not give a number of exposed stores.

What to do

• Apply Adobe's 2026-oct release or the isolated patch for CVE-2026-103849. Sansec notes that a plain Composer install is not enough.
• Keep the September VULN-39341 StyleSmuggler hotfix in place. Sansec said: "BlockStrap and StyleSmuggler are separate fixes. You need both."
• Do not delay patching based on the priority 2 rating, and monitor email template changes and server logs for unexpected template directives.