Critical BlockStrap flaw threatens Magento servers

E-commerce security firm Sansec has warned about a critical vulnerability, CVE-2026-103849, affecting Magento and Adobe Commerce. Dubbed BlockStrap, the flaw could in theory allow attackers to execute arbitrary PHP code on the servers of online stores.

No attacks exploiting the bug have been observed yet, but researchers are confident that criminals will soon find a way to abuse it. Their forecast rests on a telling fact: Sansec's analysts identified four possible attack paths in under 24 hours.

What is at risk

The vulnerability affects September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Adobe's bulletin of October 13 describes the flaw as an improper neutralization of special elements in a template engine, leading to arbitrary code execution.

As Sansec explains, BlockStrap is a second-pass template-engine directive injection: attacker-controlled content in a child email template gets signed and processed again at the root level, executing a smuggled {{block}} directive.

Why experts are alarmed

Sansec faults Adobe for assigning the flaw a "priority 2" rating, which calls for patching within 30 days. In the firm's view, that rating fails to reflect the real danger. Although the attack path is complex, "anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," the researchers note.

As a cautionary precedent they point to another bug, StyleSmuggler, which went from a priority-1 hotfix to mass exploitation in just three days. BlockStrap, in Sansec's assessment, is of similar complexity — and the vulnerability itself exposes a gap left by the StyleSmuggler fix in the same email-template engine.

What administrators should do

Adobe closed the hole by replacing generic processing with registered placeholders. Sansec stresses, however, that a plain Composer install is not enough: administrators must apply the 2026-oct release or Adobe's isolated patch.

The company reminds users that BlockStrap and StyleSmuggler are separate fixes, so both are needed; the September VULN-39341 hotfix must stay in place. Sansec promises a further update once it detects waves of mass attacks, which it expects soon.

Source: Bleeping Computer