Critical Magento BlockStrap Flaw Could Let Attackers Execute PHP Code on Store Servers

Security researchers are warning that attackers could exploit a maximum-severity vulnerability in Magento and Adobe Commerce to execute arbitrary PHP code on affected store servers.

Tracked as CVE-2026-103849 and dubbed BlockStrap, the flaw has not yet been observed in attacks. However, e-commerce security firm Sansec expects attackers to develop working exploits soon.

Researchers identified four potential attack paths related to CVE-2026-103849 within 24 hours, prompting concerns that the vulnerability could be weaponized quickly.

Magento and Adobe Commerce versions affected

The vulnerability affects September versions of Adobe Commerce and Magento Open Source through version 2.4.9. Adobe Commerce B2B versions through 1.5.3 are also affected.

Adobe assigned the flaw a “Priority 2” rating, which generally indicates that a patch should be applied within 30 days. Sansec warned that this rating does not reflect the potential danger or urgency of the vulnerability, despite the attack vector being more complex.

“The attack vector is complex, but with an AI agent, anyone can reverse engineer a patch and make the exploit work in a relatively short amount of time,” Sansec said.

“That’s why we question Adobe’s priority 2 rating (patches within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.”

How the BlockStrap vulnerability works

Adobe disclosed the vulnerability on October 13. The flaw involves improperly disabling special elements used by the template engine, potentially allowing arbitrary code execution.

Sansec described BlockStrap as a second-pass template-engine directive injection flaw. Attacker-controlled content in child email templates can be signed and processed again at the root level, allowing a smuggled {{block}} directive to execute.

According to Sansec’s analysis, BlockStrap exposes gaps left by the StyleSmuggler modification of the same email template engine. Adobe’s fix replaces generic actions with registered placeholders to prevent abuse.

Magento administrators urged to apply both hotfixes

Sansec said that a simple Composer installation is not enough to mitigate the risk. Website administrators should apply either the October 2026 release or Adobe’s one-off patch.

Administrators must also apply both relevant hotfixes. BlockStrap and StyleSmuggler are separate fixes, and the September VULN-39341 hotfix should remain installed.

“BlockStrap and StyleSmuggler are separate hotfixes. You need both, so keep the September VULN-39341 hotfix as well,” Sansec warned.

The e-commerce security company said it will provide updates if it detects the expected wave of large-scale attacks.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report