Security researchers are warning that hackers could soon exploit a maximum-severity vulnerability affecting Magento Open Source and Adobe Commerce, potentially allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable e-commerce servers.
Tracked as CVE-2026-103849 and dubbed “BlockStrap” by e-commerce security firm Sansec, the vulnerability carries a CVSS severity score of 10.0, the highest possible rating. Although Sansec has not observed attacks exploiting the flaw in live stores, researchers believe working exploits could emerge soon.
In a report published on October 15, Sansec said its researchers identified and reproduced four potential attack paths within 24 hours. The findings suggest that attackers could reverse-engineer Adobe’s security patch to develop working exploits, even though the vulnerability involves a relatively complex attack technique.
The vulnerability affects the email template engine used by Magento and Adobe Commerce. According to Adobe’s security bulletin, the flaw involves improper neutralization of special elements used in a template engine, potentially leading to arbitrary code execution.
Sansec’s technical analysis of BlockStrap explains that the issue stems from a second-pass template directive injection. In this scenario, attacker-controlled content inside a child email template can be processed and signed before being scanned again at the root level. This allows a malicious {{block}} directive to be interpreted as executable template logic.
The vulnerability also highlights a weakness left behind by the earlier StyleSmuggler security fix, which addressed a similar problem in Magento’s email template engine. Adobe’s October patch replaces the generic template-processing mechanism with registered placeholders, preventing the vulnerable second-pass processing behavior.
Sansec has questioned Adobe’s decision to assign the security update a Priority 2 rating, which generally allows administrators up to 30 days to apply a fix. The researchers pointed to the earlier StyleSmuggler vulnerability, which moved from an emergency hotfix to widespread exploitation within three days, as a warning of how quickly attackers could weaponize a similar flaw.
Adobe published its security bulletin, APSB26-153, on October 13, 2026. The advisory covers multiple vulnerabilities, including BlockStrap, and states that Adobe was not aware of exploitation in the wild for the issues addressed by the update at the time of publication.
The affected products include Adobe Commerce versions up to and including the September releases of the 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 branches, as well as Magento Open Source and Adobe Commerce B2B releases listed in Adobe’s advisory. Administrators should consult the official security bulletin to confirm the affected build and appropriate patch for their installation.
Sansec warns that simply running a standard Composer installation may not resolve the issue. Store owners should apply Adobe’s October 2026 security release or the applicable isolated patch. They must also retain the September VULN-39341 hotfix addressing StyleSmuggler, as the two vulnerabilities require separate fixes.
With unauthenticated remote code execution potentially at stake, a successful attack could give an attacker control over the vulnerable store server, creating risks for website integrity, customer information and e-commerce operations.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Sansec says it will provide further updates if it detects widespread exploitation. Until then, administrators should treat the vulnerability as urgent, verify that both security fixes are installed, and check their systems for signs of compromise.
Critical Magento Flaw Could Let Hackers Execute PHP Code on E-Commerce Servers
