Researchers warn that hackers could soon exploit a maximum severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce that could potentially allow them to execute arbitrary PHP code on store servers.
According to e-commerce security firm Sansec, no attacks exploiting the vulnerability called BlockStrap have been observed so far, but threat actors are expected to find a way to exploit it.
The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours.
The bug affects September versions of Adobe Commerce and Magento Open Source up to 2.4.9 and Adobe Commerce B2B up to 1.5.3.
The security company warned that Adobe’s classification of this vulnerability as “Priority 2” does not reflect the danger and urgency in this case, despite the more complex attack path.
“The attack path is complex, but anyone with an AI agent can turn the patch into working exploits in a relatively short period of time.” Sansec explained.
“For this reason, we question Adobe’s Priority 2 designation (patch within 30 days). StyleSmuggler went from a Priority 1 hotfix to mass adoption in three days, and BlockStrap is of similar complexity.”
Adobe’s Bulletinpublished on October 13, describes the flaw as an improper neutralization of special elements used in a template engine, resulting in arbitrary code execution.
Sansec explains that BlockStrap is a second-pass template engine directive injection that allows attackers to sign and reprocess controlled content in a child email template at the root level, executing a smuggled {{block}} directive.
According to Sansec’s analysis, BlockStrap uncovers a vulnerability created by the StyleSmuggler fix in the same email template engine.
Adobe’s fix replaces generic processing with registered placeholders, preventing exploitation.
According to Sansec, a simple Composer installation is not enough to address the risk and website administrators must apply Adobe’s Oct 2026 release or isolated patch.
“BlockStrap and StyleSmuggler are separate fixes. They require both, so keep the September hotfix VULN-39341 as well,” warns Sansec.
The e-commerce security company says it will provide an update as it detects waves of mass attacks that it expects to occur soon.
