GoKawiilResearchers warn Magento's BlockStrap flaw could soon be weaponized
Sansec has disclosed CVE-2026-103849, dubbed BlockStrap, a maximum-severity vulnerability in Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3 that could let attackers execute arbitrary PHP code via a second-pass injection in the email template engine. No active exploitation has been observed yet, but Sansec says it found four potential attack paths within a day of analysis and is urging merchants to apply Adobe's October patch or isolated fix rather than relying on a standard Composer install.
GoKawiil's interpretation of the reporting above, not reported fact.
Sansec argues Adobe's 'priority 2' rating, which allows 30 days to patch, understates the risk given that a similar prior flaw, StyleSmuggler, went from disclosure to mass exploitation in three days. The firm suggests that AI-assisted reverse-engineering of patches could shorten the window attackers need to weaponize complex vulnerabilities, a dynamic that may pressure vendors to reconsider how they prioritize patch timelines.
- BlockStrap (CVE-2026-103849) is a maximum-severity flaw in Magento/Adobe Commerce enabling arbitrary PHP code execution
- Sansec says no exploitation has been seen yet but expects attackers to develop exploits soon
- Store administrators are advised to apply Adobe's 2026-oct release or isolated patch rather than a plain Composer install
Source: bleepingcomputer.com, 2026-10-16
Published there as: “Critical BlockStrap flaw lets hackers run code on Magento servers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.