Full Report
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
Analysis Summary
# Vulnerability: BlockStrap, Template Engine Directive Injection in Magento and Adobe Commerce
## CVE Details
- CVE ID: CVE-2026-103849
- CVSS Score: Not stated in the article. Described as "maximum-severity," which suggests 10.0 (Critical), but verify against the NVD or Adobe bulletin.
- CWE: Not stated in the article. The vendor description ("improper neutralization of special elements used in a template engine") matches CWE-1336, but this mapping is inferred.
## Affected Systems
- Products:
- Adobe Commerce
- Magento Open Source
- Adobe Commerce B2B
- Versions:
- September versions of Adobe Commerce and Magento Open Source through 2.4.9
- Adobe Commerce B2B through 1.5.3
- Configurations: The flaw is in the email template engine. Exposure depends on the attacker being able to supply content in a child email template that is then signed and processed at the root level. The article does not describe further configuration requirements.
## Vulnerability Description
BlockStrap is a second-pass template engine directive injection in the Magento/Adobe Commerce email template engine. Attacker-controlled content in a child email template is signed and processed again at the root level, which causes a smuggled `{{block}}` directive to execute. This leads to arbitrary PHP code execution on the store server.
Sansec describes BlockStrap as a gap left by the StyleSmuggler fix in the same email-template engine. Adobe's fix for this issue replaces generic template processing with registered placeholders. Adobe's bulletin is APSB26-153, published October 13, 2026.
## Exploitation
- Status: Not exploited (no attacks observed as of the article's publication). Sansec expects exploitation soon.
- PoC availability: No public PoC is reported. Sansec states that the patch can be reverse-engineered into working exploits "in a relatively short time," and identified four potential attack paths within 24 hours.
- Complexity: High. Sansec describes the attack path as complex, though it considers the practical risk high given the speed at which patches can be turned into exploits.
- Attack Vector: Network (inferred; the article does not state this explicitly).
Context: Sansec notes that Adobe rated this "priority 2" (patch within 30 days). The same firm observed StyleSmuggler move from a priority 1 hotfix to mass exploitation within three days, and considers BlockStrap of similar complexity.
## Impact
These ratings are inferred from the reported arbitrary code execution and should be confirmed against the Adobe bulletin.
- Confidentiality: High (inferred). Code execution on the server could expose customer, payment, and order data.
- Integrity: High (inferred). Attackers could modify store code, inject skimmers, or deploy backdoors.
- Availability: High (inferred). Attackers could disrupt store operations.
## Remediation
### Patches
- Apply the **2026-oct release** from Adobe, or Adobe's **isolated patch** for APSB26-153.
- Keep the **September VULN-39341 hotfix** (the StyleSmuggler fix) in place. Sansec states that BlockStrap and StyleSmuggler are separate fixes and both are required.
- A standard Composer install alone is not sufficient, according to Sansec.
### Workarounds
- The article does not describe vendor-approved workarounds. Until patched:
- Restrict who can create or modify email templates, including through admin access.
- Review and limit any feature that accepts user-supplied email template content.
- Consider temporarily disabling untrusted email template customization where operationally feasible.
## Detection
The article does not provide indicators of compromise. The following are general recommendations:
- Audit email template records in the database (for example, `email_template` content) for `{{block}}` directives or unexpected template changes, especially in child templates.
- Look for newly created or modified PHP files in the webroot, `app/code`, `generated/`, and `pub/` directories, and compare against a known-good baseline.
- Review web server and admin logs for unusual requests to email template management or preview functions.
- Check for unexpected scheduled tasks, cron entries, or outbound connections from the store server.
- Monitor Sansec's updates. The firm says it will publish an update when it detects mass attack waves.
## References
- Original article: bleepingcomputer[.]com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
- Adobe security bulletin APSB26-153: adobe[.]com/trust/security/products/commerce/apsb26-153.html
- Sansec research: sansec[.]io/research/blockstrap-magento-rce
- Related StyleSmuggler coverage: bleepingcomputer[.]com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/