Critical BlockStrap Flaw Could Enable Code Execution on Magento Servers
Summary
CVE-2026-103849 affects Magento and Adobe Commerce and could enable arbitrary PHP execution. Sansec says attacks have not been observed but may emerge soon; administrators should apply the 2026-oct release or Adobe’s isolated patch and retain the StyleSmuggler hotfix.
Key points
- The BlockStrap flaw, CVE-2026-103849, could allow arbitrary PHP code execution on Magento and Adobe Commerce servers.
- Affected versions include September releases through Magento Open Source and Adobe Commerce 2.4.9, and Adobe Commerce B2B 1.5.3.
- Sansec describes a second-pass template-engine directive injection involving attacker-controlled content in child email templates.
- Sansec identified four potential attack paths in under 24 hours but said exploitation had not yet been observed.
- Adobe’s fix uses registered placeholders to prevent exploitation.
- Administrators should install the 2026-oct release or Adobe’s isolated patch and retain the September VULN-39341 StyleSmuggler hotfix; Sansec says both fixes are needed.
Article Details
- Vulnerability Types
- Second-pass template engine directive injection
- Improper neutralization of special elements in a template engine
- Severity
- Maximum severity; Adobe rated it priority 2, which Sansec said understated the danger.
- Affected Versions
- Adobe Commerce September versions through 2.4.9
- Magento Open Source September versions through 2.4.9
- Adobe Commerce B2B September versions through 1.5.3
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply the 2026-oct release or Adobe’s isolated patch.
- Keep the September VULN-39341 hotfix in place; Sansec says both the BlockStrap and StyleSmuggler fixes are needed.