Critical BlockStrap flaw lets hackers run code on Magento servers

A maximum-severity flaw in Magento and Adobe Commerce could let attackers run arbitrary PHP code on store servers, according to researchers at e-commerce security firm Sansec. The vulnerability is tracked as CVE-2026-103849 and has been named BlockStrap. Sansec said it has not yet observed attacks exploiting the flaw, but it expects threat actors to develop working exploits.

The researchers reached that assessment after identifying four possible attack paths involving CVE-2026-103849 in under 24 hours. The flaw affects September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Adobe published a bulletin on October 13 describing the issue as improper neutralization of special elements used in a template engine, leading to arbitrary code execution.

Sansec disputed Adobe's "priority 2" rating for the flaw, which calls for a patch within 30 days. The security firm said the rating does not reflect the danger and urgency of the situation, even though the attack path is more complex. It noted that anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time. As a comparison, Sansec pointed to StyleSmuggler, which moved from a priority 1 hotfix to mass exploitation in three days and is of similar complexity to BlockStrap.

According to Sansec, BlockStrap is a second-pass template engine directive injection that lets attacker-controlled content in a child email template be signed and processed again at the root level, executing a smuggled {{block}} directive. The firm said the flaw exposes a gap left by the StyleSmuggler fix in the same email-template engine. Adobe's fix replaces the generic processing with registered placeholders to prevent exploitation.

Sansec cautioned that a plain Composer install is not enough to address the risk. Website administrators must apply the 2026-oct release or Adobe's isolated patch, the firm said. It added that BlockStrap and StyleSmuggler are separate fixes and that the September VULN-39341 hotfix must remain in place as well.

Sansec said it will provide an update when it detects mass attack waves, which it expects to occur soon. The disclosure comes as Adobe Commerce and Magento store operators face pressure to keep pace with overlapping template-engine fixes. The affected releases are used by online retailers, including merchants selling into the US market.

More cybersecurity news from TechManNews.