Magento / Adobe Commerce 'BlockStrap' CVE-2026-103849 (CVSS 10.0): unauthenticated PHP code execution through the email template engine — apply the October patch (APSB26-153) and keep the September StyleSmuggler hotfix
Adobe's security bulletin APSB26-153, published on 13 October 2026, fixes CVE-2026-103849, a template-engine injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker run arbitrary PHP on the store server. E-commerce security firm Sansec, which named the flaw BlockStrap (reported to Adobe by researcher vozec), said on 15 October that it reproduced four separate routes to code execution within 24 hours of the patch, although it had not yet seen attacks on live stores. BlockStrap is a second-pass directive injection: September's StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) signs trusted template directives, but attacker-controlled data in a child email template can still be signed and re-scanned at the root level, where a smuggled {{block}} directive runs. Adobe's fix replaces that generic re-scan with registered placeholders. Adobe rated the bulletin priority 2 (patch within 30 days) because it reserves priority 1 for flaws it knows are exploited; Sansec disputes that, noting StyleSmuggler went from hotfix to mass exploitation in three days. A plain Composer install still pulls the vulnerable base version, so stores need the 2026-oct release or Adobe's isolated patch, and the October patch does not include the StyleSmuggler hotfix, which must stay installed separately. Public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9; patches for 2.4.4 to 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade. Mage-OS 3.6.0 (14 October) includes the fix. Primary: Adobe APSB26-153; research: Sansec (15 Oct); wire: BleepingComputer (16 Oct).
- Product
- Adobe Commerce, Adobe Commerce B2B and Magento Open Source (also Mage-OS)
- Versions
- Affected: Adobe Commerce and Magento Open Source up to and including the September releases through 2.4.9; Adobe Commerce B2B through 1.5.3; Mage-OS up to 3.5.0. Fixed: 2026-oct release or Adobe's isolated patch (Open Source 2.4.7-p10, 2.4.8-p5, 2.4.9; Commerce-licensed patches for 2.4.4-p18, 2.4.5-p17, 2.4.6-p15); Mage-OS 3.6.0.
- CVSS
- 10.0 Critical (per Sansec; Adobe priority 2)
- Exploited in Australia?
- unknown
- Patch to
- Apply the 2026-oct release or Adobe's isolated APSB26-153 patch now rather than inside Adobe's 30-day window, and keep the September VULN-39341 StyleSmuggler hotfix installed (install it first). Confirm the fix landed: grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php should return more than 0 (on Mage-OS check vendor/mage-os/framework/Filter/Template.php). Open Source stores on 2.4.6 or older must upgrade to 2.4.7-p10 or later. Check for backdoors on stores that were exposed.
Primary: Adobe — APSB26-153 security update for Adobe Commerce and Magento Open Source (13 Oct 2026) · Vendor: Sansec — BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849), 15 Oct 2026 · CVE: CVE-2026-103849, CVE-2026-75650 · BleepingComputer — Critical BlockStrap flaw lets hackers run code on Magento servers (16 Oct 2026)