"The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," Sansec said.
CVE-2026-103849: a maximum-severity template-engine flaw
Researchers at e-commerce security firm Sansec disclosed a critical vulnerability, tracked as CVE-2026-103849 and nicknamed BlockStrap, that affects Adobe Commerce and Magento Open Source. Adobe’s bulletin, published on October 13, describes the flaw as an improper neutralization of special elements used in a template engine, a condition that can lead to arbitrary code execution on vulnerable servers.
How BlockStrap enables arbitrary PHP execution
Sansec’s analysis identifies BlockStrap as a second-pass template-engine directive injection. The firm explains that attacker-controlled content injected into a child email template can be signed and then processed again at the root template level. That second processing can execute a smuggled {{{{block}}}} directive, allowing arbitrary PHP code to run on the store server if the attack path is completed.
Adobe’s bulletin frames the underlying defect in the same terms—unsafe handling of template elements that permit unexpected execution—while Adobe’s fix replaces generic processing with registered placeholders to prevent the smuggling and reprocessing that BlockStrap relies on.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogScope: which Magento and Adobe Commerce installations are at risk
Sansec lists the affected releases as September versions of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3. The security firm warns that a plain Composer install is not sufficient to mitigate the risk; administrators must apply the October 2026 release (the 2026-oct release) or Adobe’s isolated patch to fully address the vulnerability.
Sansec also stresses that BlockStrap is not a substitute for earlier fixes: the September VULN-39341 hotfix (the patch sometimes referred to in connection with StyleSmuggler) must remain in place because BlockStrap and StyleSmuggler are separate vulnerabilities requiring separate fixes.
Sansec’s rapid assessment and Adobe’s priority rating
Sansec reports it found four potential attack paths involving CVE-2026-103849 in less than 24 hours and warned that, while attacks exploiting BlockStrap have not yet been observed, threat actors are likely to develop working exploits soon. The firm explicitly questioned Adobe’s assignment of a “priority 2” rating—which carries a 30-day remediation window—saying that the rating “does not reflect the danger and urgency in this case.”
Sansec draws a parallel to the earlier StyleSmuggler incident, which it says moved from a priority 1 hotfix to mass exploitation in three days. Sansec argued the BlockStrap fix is of similar complexity and that AI-assisted reverse-engineering of Adobe’s patch could shorten the time to a workable exploit.
What this means for Magento administrators, e-commerce operators, and attackers
- Magento administrators and e-commerce operators: Sansec’s guidance is explicit—apply the 2026-oct release or Adobe’s isolated patch immediately, and keep the September VULN-39341 hotfix in place. A plain Composer install does not fully address the gap the researchers identified.
- Threat actors and exploit developers: Sansec warns that the attack path complexity is surmountable and that AI tools can accelerate patch reversal into working exploits; the firm says it expects mass attack waves “soon” and will provide updates when it detects them.
- Security and risk teams measuring defenses: the Blue Report 2026 — cited in the advisory — notes that overall prevention scores can mask problems after initial access; once attackers possess valid credentials, prevention efficacy drops sharply. The report measures defenses technique by technique across 338 million simulations run in customer production environments.
Immediate steps and final assessment
Adobe has published a fix that replaces generic template processing with registered placeholders; Sansec endorses that approach but warns that remaining gaps from prior template fixes must be addressed in tandem. Because Sansec located multiple attack paths quickly and expects exploitation to follow, the practical risk window for unpatched stores is short.
The central fact is straightforward: BlockStrap allows reprocessing of signed child templates to smuggle and execute a {{{{block}}}} directive, and Adobe’s published fix plus the October release are the designated mitigations. Administrators who delay or who assume a Composer installation is sufficient may be exposed to rapid exploitation. Sansec plans to announce when mass exploitation begins; until then, the imperative on operators is clear—apply the released patches and retain the September VULN-39341 hotfix.
Source: BleepingComputer — Critical BlockStrap flaw lets hackers run code on Magento servers
