Adobe has patched a critical vulnerability in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker execute arbitrary code on a store's server. Adobe's security bulletin APSB26-153, published October 13, 2026, covers 11 vulnerabilities across Adobe Commerce, Adobe Commerce B2B and Magento Open Source. The most serious, CVE-2026-103849, has the maximum CVSS 3.1 score of 10.0.

Adobe says it is "not aware of any exploits in the wild for any of the issues addressed in this update" and assigned the update Priority 2. The e-commerce security firm Sansec, which named the flaw "BlockStrap," said as of October 16 that it had not yet seen attacks. It expects them anyway, and it warns that a routine install of the update may leave a store exposed.

What the flaw is

Adobe classifies CVE-2026-103849 as CWE-1336, improper neutralization of special elements used in a template engine. The NVD entry, still marked "Undergoing Analysis" as of October 19, carries Adobe's description: the issue "could result in arbitrary code execution in the context of the current user" and "exploitation of this issue does not require user interaction. Scope is changed." The vector Adobe's PSIRT supplied is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity and availability. Adobe credits the report to a researcher using the handle vozec.

According to BleepingComputer's account of Sansec's analysis, BlockStrap is a second-pass directive injection in the Magento email-template engine that could let an attacker run arbitrary PHP on the store server. Sansec says the bug exposes a gap left by the fix for an earlier flaw in the same engine, which it tracked as StyleSmuggler. Adobe's fix replaces the engine's generic processing with registered placeholders, BleepingComputer reported. The two problems need separate patches: "BlockStrap and StyleSmuggler are separate fixes. You need both," Sansec said.

The NVD record also shows outside activity since the bulletin. A CISA-coordinator SSVC assessment added on October 19 rates exploitation status as "poc" (a public proof of concept), automatable as "yes" and technical impact as "total." The same source added a reference to a public GitHub repository labeled as a BlockStrap lab. Neither entry reports attacks in the wild.

Who is affected

The bulletin lists these affected and fixed versions:

  • Adobe Commerce 2.4.4 through 2.4.9 (2026-sep releases and earlier). Fixed in 2.4.4-2026-oct through 2.4.9-2026-oct and in 2.4.10-alpha1.
  • Magento Open Source 2.4.6 through 2.4.9 (2026-sep releases and earlier). Fixed in 2.4.7-2026-oct through 2.4.9-2026-oct and in 2.4.10-alpha1. The bulletin's fixed-versions table does not list an October build for 2.4.6.
  • Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3 (2026-sep releases and earlier). Fixed in the -2026-oct builds of those versions and in 1.5.4-alpha1.

Adobe makes one prerequisite explicit. Stores must also apply the hotfix for CVE-2026-75650, which Adobe released in critical bulletin APSB26-146 on September 7, 2026.

The rest of the bulletin

CVE-2026-103849 is one of five critical-rated issues in APSB26-153. Adobe lists the other four as:

  1. CVE-2026-92909: CVSS 9.8, incorrect authorization leading to code execution, no authentication required, affecting Adobe Commerce B2B
  2. CVE-2026-91013: CVSS 9.3, stored cross-site scripting leading to privilege escalation
  3. CVE-2026-100133: CVSS 9.3, stored cross-site scripting leading to privilege escalation
  4. CVE-2026-92464: CVSS 9.1, improper input validation leading to code execution; requires high privileges

The other six entries are rated high (five, from CVSS 8.7 down to 7.2) or medium (one, CVSS 4.3). Three of the 11 flaws, CVE-2026-92909, CVE-2026-92908 and CVE-2026-92910, are specific to the B2B extension.

Adobe's rating vs. Sansec's warning

Sansec disputes Adobe's Priority 2 rating. It said it found four potential attack paths in under 24 hours of analysis, and that "anyone with an AI agent can reverse-engineer the patch into working exploits" in a relatively short time, as quoted by BleepingComputer on October 16. "That is why we question Adobe's priority 2 rating (patch within 30 days)," the company said.

Sansec points to StyleSmuggler as precedent. That flaw went from a Priority 1 hotfix to mass exploitation in three days, and Sansec describes BlockStrap as being of similar complexity.

Sansec also warned about how the fix is installed. A plain Composer install is not enough, the company said. Administrators need either the 2026-oct release or Adobe's isolated patch, and the September hotfix, which Sansec refers to as VULN-39341, should stay in place.

What It Means for Defenders

  • Move to the October builds. Upgrade each instance to the -2026-oct release for its branch, or apply Adobe's isolated patch if an upgrade has to wait. Magento Open Source 2.4.6 users should note that the bulletin lists no October build for that branch.
  • Audit every environment for the September hotfix. That includes staging and disaster-recovery copies. Without the CVE-2026-75650 fix, the October update alone does not meet Adobe's stated requirement.
  • Verify the patched files after deployment. Confirm the changed template-engine code is actually on disk. Don't treat a successful package command as proof.
  • Patch internet-facing storefronts first. The flaw needs no login and no user action, so production stores should go ahead of internal and development systems.
  • Look for signs of compromise. Review email templates for unexpected changes, the web root for new or modified PHP files, and the admin panel for unfamiliar accounts. If you find any, rotate database credentials, API keys and admin passwords, and check checkout pages for injected scripts. Sansec says it will publish an update when it detects mass attack waves.

Sources