A critical flaw in Adobe Commerce and Magento could let attackers take over online store servers by running malicious PHP code. Tracked as CVE-2026-103849 and dubbed BlockStrap, the bug affects September releases of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. Sansec says it is an email-template engine directive-injection issue and warns administrators must apply Adobe’s 2026-oct release or isolated patch; a plain Composer install is not enough.
Why it matters: Organizations running affected Adobe Commerce or Magento systems should treat this as urgent even before mass exploitation is confirmed, because public analysis suggests working exploits could appear quickly. Online stores should patch now and ensure the earlier StyleSmuggler hotfix remains in place.
Bill Toulas
2026.10.16
100% relevant
This article appears to be the first tracked report focused on CVE-2026-103849 BlockStrap itself, including affected versions, exploit expectations, and remediation details.
← Back to all stories