Critical BlockStrap Flaw Lets Hackers Run Code on Magento and Adobe Commerce Servers

Security firm Sansec has disclosed a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that lets an attacker run arbitrary PHP code on an online store's server by smuggling a malicious directive through the platform's own email template engine. Adobe published a fix on October 13, 2026, but Sansec says it found four distinct ways to exploit the flaw within 24 hours of analyzing the patch — and warns that an AI coding agent could plausibly reverse-engineer a working exploit from the published fix in a similarly short window.

This matters because Magento and Adobe Commerce still power a large share of mid-sized online retailers worldwide, and remote code execution on a store's server typically means full compromise: customer payment data, admin credentials, and the ability to plant further malware all become reachable in one step.

What the vulnerability does

Sansec, which codenamed the flaw "BlockStrap" and catalogued it as CVE-2026-103849, describes it as a "second-pass template engine directive injection." Magento's email templates process certain content twice: once for a child template, and again when that output is merged into the root template. Sansec found that attacker-controlled content placed in the first pass can smuggle a {{block}} directive that only executes when the content is reprocessed at the root level — a flaw in how the two passes interact, not an obvious injection point either pass would catch on its own.

Severity and disagreement over urgency

Adobe's own security bulletin, APSB26-153, classifies the issue as "priority 2," meaning Adobe's recommended patching window is 30 days. Sansec publicly disputes that rating, arguing the ease of exploitation and the potential for full server compromise warrant treating it as critical and patching immediately rather than on Adobe's standard 30-day cycle.

Who's affected and what to do

The flaw affects Adobe Commerce and Magento Open Source through version 2.4.9, as well as Adobe Commerce B2B through version 1.5.3. Sansec says a plain Composer-based update is not sufficient on its own; store operators need to apply either Adobe's October 2026 release or the isolated patch distributed alongside APSB26-153. The firm also notes that BlockStrap is unrelated to a separate flaw it disclosed in September, codenamed StyleSmuggler, so stores must keep that earlier hotfix (VULN-39341) in place as well rather than treating the new patch as a replacement.

No confirmed attacks yet, but a short window

Sansec says it has not observed active exploitation in the wild as of its disclosure, and has committed to publishing an update if it detects mass attack activity. Given the firm's own four-path exploitation timeline and its warning about AI-assisted exploit development, the realistic patching window before broad exploitation attempts begin is likely measured in days rather than Adobe's stated 30.