BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
by Sansec Forensics Team
Published in Threat Research − October 15, 2026
BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable.
BlockStrap is the second critical break in Magento's email template engine in six weeks. It has the same CVSS 10.0 score as StyleSmuggler and the same impact: an unauthenticated attacker runs arbitrary PHP on the store server.
Adobe patch: CVE-2026-103849
Adobe published APSB26-153 on October 13. The most critical issue is BlockStrap, a template engine injection at CVSS 10.0, found by vozec.
| Product | Affected versions |
|---|---|
| Adobe Commerce | ≤ 2.4.9 |
| Adobe Commerce B2B | ≤ 1.5.3 |
| Magento Open Source | ≤ 2.4.9 |
Beware though!
- A plain Composer install still has the vulnerable base version, so apply the
2026-octrelease or Adobe's isolated patch. - BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September
VULN-39341hotfix in place as well.
Builds upon StyleSmuggler
BlockStrap is a second-pass directive injection, like StyleSmuggler. The September VULN-39341 hotfix signs trusted directives, but attacker-controlled data in a child template can still be signed and rescanned at the root level, where a smuggled {{block}} directive runs inside Magento's rendering. Adobe's October patch replaces that generic rescan with registered placeholders.
Four routes to code execution in 24 hours
The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time. That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.
What merchants should do
Recall your team from vacation and start patching today. If you cannot patch within hours, Sansec Shield blocks BlockStrap at the HTTP layer, with rules live for all Shield stores. Run eComscan to flag the missing patch and check for backdoors.
Timeline
| Date | Event |
|---|---|
| 2026-09-07 | Adobe ships the StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) |
| 2026-10-13 | Adobe publishes APSB26-153 fixing BlockStrap (CVE-2026-103849), CVSS 10.0, priority 2 |
| 2026-10-14 | Sansec reproduces four code-execution routes and deploys Shield protection |
| 2026-10-15 | Sansec publishes this analysis; no exploitation observed on live stores yet |
We will update this article when we identify mass attack waves.
Read more
- StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
- PolyShell: unrestricted file upload in Magento and Adobe Commerce
- SessionReaper attacks have started, 3 in 5 stores still vulnerable
- SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)
- Adobe patches critical Magento admin takeover via menu injection
In this article
Protect your store now!
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
Get Sansec ShieldScan your store now
for malware & vulnerabilities
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
Learn more
