The BlockStrap flaw could allow attackers to execute arbitrary PHP code on servers running Magento Open Source and Adobe Commerce. Researchers warn that store operators should apply the available fix promptly, despite no observed attacks so far.
Tracked as CVE-2026-103849, the maximum-severity vulnerability affects the platforms’ email-template engine. Security firm Sansec identified four potential attack paths within 24 hours, raising concerns that attackers could develop working exploits quickly.
Which Magento and Adobe Commerce Versions Are Affected?
According to the disclosure, affected September releases include Adobe Commerce and Magento Open Source through version 2.4.9. Adobe Commerce B2B through version 1.5.3 is also affected.
Adobe published its security bulletin on October 13. It describes a template-engine vulnerability that can lead to arbitrary code execution.
However, Sansec disputes Adobe’s priority 2 classification, which recommends patching within 30 days. The researchers argue that the potential consequences and speed of exploit development warrant faster action.
Although the attack requires a complex sequence, Sansec believes attackers could use AI tools to reverse-engineer the patch and shorten development time.
Email Template Processing Creates an Attack Path
The BlockStrap flaw involves content passing through the email-template engine more than once.
Sansec explains that attacker-controlled content inside a child email template can receive a valid signature before the engine processes it again. During that second pass, the system may interpret a concealed block directive as an instruction.
As a result, content that should remain data can influence template execution and potentially trigger PHP code on the server.
Researchers describe the issue as a gap remaining after the earlier StyleSmuggler fix. Both vulnerabilities involve the same email-template engine, but each requires its own patch.
Researchers Warn Exploitation Could Follow Quickly
At the time of Sansec’s report, researchers had not observed attacks exploiting CVE-2026-103849. Nevertheless, their discovery of multiple potential attack paths prompted an urgent warning.
For comparison, Sansec pointed to the recent StyleSmuggler vulnerability. That issue progressed from an emergency fix to widespread exploitation within three days.
The researchers consider BlockStrap similarly complex. Consequently, they caution against treating the absence of detected attacks as a reason to delay updates.
However, their warning remains a forecast. The report does not establish that attackers have already developed or deployed a working BlockStrap exploit.
Stores Need the October Fix and September Hotfix
Adobe’s correction changes how the template engine handles the affected content. It uses registered placeholders in place of generic processing to prevent the vulnerable behavior.
According to Sansec, running a standard Composer installation alone does not resolve the risk. Administrators must apply the 2026-oct release or Adobe’s isolated patch.
They must also retain the September VULN-39341 hotfix for StyleSmuggler. The October BlockStrap correction addresses a separate issue and does not remove the need for that earlier protection.
Sansec says it will publish further findings if it detects widespread attacks. For now, its recommendation is to apply the required fixes before exploitation begins.
0 responses to “Critical BlockStrap Flaw Puts Magento Servers at Risk”