A maximum-severity vulnerability in Adobe Commerce and Magento Open Source could allow unauthenticated attackers to execute arbitrary code on affected store servers. Adobe published a bulletin for CVE-2026-103849 on October 13, 2026, according to a BleepingComputer report published on October 16.
Security company Sansec, which named the flaw “BlockStrap,” said it had not observed attacks exploiting the vulnerability. However, the company identified four potential attack paths in less than 24 hours and expects threat actors to develop working exploits.
Products and versions listed as affected
The reported affected range includes:
- Adobe Commerce “September versions,” a term not further defined in the report
- Magento Open Source through 2.4.9
- Adobe Commerce B2B through 1.5.3
CVE-2026-103849 is classified as CWE-1336, improper neutralization of special elements used in a template engine. Its CVSS 3.1 score is 10.0, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
That assessment describes a network-accessible flaw requiring neither privileges nor user interaction. Successful exploitation could affect confidentiality, integrity and availability beyond the initially vulnerable component.
How the template injection reaches PHP execution
According to Sansec’s analysis, BlockStrap is a second-pass template-engine directive injection vulnerability.
Attacker-controlled content placed in a child email template is signed and later processed again at the root-template level. During that additional processing stage, a concealed {{block}} directive can be interpreted as an active instruction rather than harmless template content.
Sansec says this chain can ultimately provide arbitrary PHP code execution on the commerce server. In practical terms, successful attackers could run code with the permissions available to the affected application environment.
The Adobe fix reportedly replaces generic template processing with registered placeholders, preventing attacker-supplied directives from being interpreted through this route.
BlockStrap affects the same email-template engine involved in the earlier StyleSmuggler issue. Sansec characterizes the new vulnerability as a gap left by that previous repair, but the two flaws require separate fixes.
Adobe and Sansec differ on patch urgency
Adobe reportedly assigned CVE-2026-103849 a priority 2 rating, described in the report as requiring patching within 30 days.
Sansec disputes that timetable. The company argues that BlockStrap presents a more immediate risk and points to StyleSmuggler, which it says progressed from a priority 1 hotfix to mass exploitation in three days.
Sansec also claims that “anyone with an AI agent” could reverse-engineer the patch and produce working exploits relatively quickly. That statement is a forecast about exploit development, not evidence that AI-assisted exploitation has occurred. Sansec’s own assessment also describes the attack path as complex.
Applying the fix requires more than a standard Composer install
Sansec lists two remediation options: install the 2026-oct release or apply Adobe’s isolated patch. According to the company, a plain Composer installation is not sufficient to resolve the vulnerability.
Administrators should also keep the September VULN-39341 hotfix in place. BlockStrap and StyleSmuggler are distinct issues, so applying the newer correction does not remove the need for the earlier fix.
For affected operators, the immediate actions are therefore to:
- Determine whether deployed Magento Open Source, Adobe Commerce or Adobe Commerce B2B versions fall within the reported ranges.
- Apply the
2026-octrelease or Adobe’s isolated patch. - Confirm that remediation was actually deployed rather than assuming a standard Composer operation covered it.
- Preserve the September
VULN-39341hotfix so both template-engine vulnerabilities remain addressed.
Sansec had not detected exploitation when the issue was reported on October 16, but its discovery of multiple potential attack paths makes patch validation more urgent than merely scheduling an eventual upgrade.
