Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit it.
The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours.
The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
The security firm warned that Adobe’s “priority 2” rating of this flaw does not reflect the danger and urgency in this case, despite the more complex attack path.
“The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time,” stated Sansec states.
“That is why we question Adobe’s priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.”
Adobe’s bulletin, published on October 13, describes the flaw as an improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
Sansec explains that BlockStrap is a second-pass template engine directive injection that allows attacker-controlled content in a child email template to be signed and processed again at the root level, executing a smuggled {{block}} directive.
According to Sansec’s analysis, BlockStrap exposes a gap left by the StyleSmuggler fix in the same email-template engine.
Adobe’s fix replaces the generic processing with registered placeholders, preventing exploitation.
Sansec says that a plain Composer install isn’t enough to address the risk, and website administrators must apply the 2026-oct release or Adobe’s isolated patch.
“BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well,” Sansec cautions.
The e-commerce security company says it will provide an update when it detects mass attack waves, which it expects to occur soon.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
