Adobe Commerce BlockStrap RCE Flaw Patched (CVE-2026-103849)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-103849: 10.0
EPSS (30-day exploit probability)	CVE-2026-103849: 0.8%
In CISA KEV (exploited)	No
Vendor	Adobe
CVE IDs	CVE-2026-103849

Adobe Commerce and Magento Open Source contain a maximum-severity code execution flaw, CVE-2026-103849, nicknamed BlockStrap. According to BleepingComputer, e-commerce security firm Sansec has not yet seen it exploited, and the flaw is not listed in CISA’s KEV catalog at the time of writing.

Sansec nevertheless expects attackers to find a way in soon, so store operators should treat the Adobe fix as urgent rather than waiting for a routine maintenance window.

What happened

Adobe published a security bulletin on October 13 describing an improper neutralization of special elements used in a template engine (CWE-1336). Successful exploitation can lead to arbitrary code execution in the context of the current user, with no user interaction required. NVD scores it CVSS 10.0 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning network reachable, low complexity, no privileges and a changed scope.

Sansec describes BlockStrap as a second-pass template engine directive injection. Attacker-controlled content in a child email template can be signed and then processed again at the root level, which executes a smuggled {{block}} directive. In Sansec’s analysis it exposes a gap left by the earlier StyleSmuggler fix in the same email-template engine. Adobe’s fix replaces the generic processing with registered placeholders.

Am I affected?

Per the reporting, the flaw affects:

September versions of Adobe Commerce and Magento Open Source, through 2.4.9
Adobe Commerce B2B through 1.5.3

NVD does not yet list affected-product data for this CVE, so confirm exact build ranges in the Adobe bulletin. If you run a customised or heavily extended storefront, assume you are in scope until you have checked.

Why this matters

Analysis, not new facts. A storefront server typically holds customer records, order data, admin sessions and payment-adjacent integrations, so code execution there is a path to data theft or card skimming. The exploit path is described as complex, yet Sansec found four potential attack paths within a day of the disclosure and argues that the patch can be reverse-engineered into working exploits quickly, including with AI assistance.

Sansec also questions Adobe’s priority 2 rating, which implies patching within 30 days. It points to StyleSmuggler, which it says went from a priority 1 hotfix to mass exploitation in three days, and says BlockStrap is of similar complexity. Our view: do not use the 30-day window as your plan. Patch within days, and within hours if exploitation is reported or the flaw is added to CISA KEV.

Technical details

Weakness: CWE-1336, template engine injection.
Attack vector: network, no privileges, no user interaction.
Exploitation status: no attacks observed by Sansec as of the report; mass attack waves are expected.
KEV status: not listed.
EPSS: 0.00778, a low current probability that will not reflect a fast-moving exploit written after patch analysis.

Note that Adobe rates the flaw lower priority than the CVSS score suggests, while Sansec argues the opposite. The two views conflict, so weigh your own exposure.

What to do

Apply the 2026-oct release or Adobe’s isolated patch. Sansec warns that a plain Composer install is not enough to address the risk.
Keep the September VULN-39341 hotfix in place. Sansec states that BlockStrap and StyleSmuggler are separate fixes and you need both.
Take a backup and test on staging, but do not let testing stretch beyond a few days.
After patching, review web server and application logs for unexpected requests touching email templates, and check for new or modified template content and unfamiliar admin users. No indicators of compromise have been published, so this is a hunting suggestion rather than a known signature.
Tell your hosting provider or agency if they manage the store for you, and ask them to confirm both fixes are installed.

Sansec says it will publish an update when it detects mass attack waves.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.