Adobe Commerce flaw opens door to arbitrary code execution on Magento stores

A maximum-severity flaw tracked as CVE-2026-103849 threatens both Magento and Adobe Commerce installations, potentially granting attackers the ability to execute arbitrary PHP code directly on affected servers. E-commerce security researchers at Sansec have flagged the vulnerability, which they call BlockStrap, as a significant risk despite no active exploitation being documented to date. However, the firm expects threat actors will develop working exploits in the near term.

Sansec identified four distinct attack vectors for the vulnerability within a single day of analysis, suggesting the flaw's complexity is manageable for determined adversaries. The vulnerability affects Adobe Commerce and Magento Open Source versions through 2.4.9 released in September, as well as Adobe Commerce B2B through version 1.5.3.

Adobe assigned the flaw a "priority 2" severity rating, which Sansec disputes as inadequate given the threat landscape. The researchers point out that CVE-2026-103849 shares similar complexity with StyleSmuggler, an earlier flaw that escalated from priority 1 status to widespread attacks in just three days. "The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," Sansec stated, adding that "That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity."

How the vulnerability works

Adobe's security bulletin, released on October 13, describes the underlying flaw as improper neutralization of special elements within a template engine, which results in arbitrary code execution. BlockStrap operates as a second-pass template engine directive injection, exploiting a mechanism where attacker-controlled content embedded in a child email template gets signed and reprocessed at the root level, ultimately executing a hidden {{block}} directive.

The vulnerability exposes a gap that persisted after the StyleSmuggler patch was applied to the same email-template engine. Adobe's remediation replaces generic processing logic with registered placeholders, effectively blocking the attack vector.

Patching requirements

Sansec warns that a standard Composer installation alone will not sufficiently mitigate the risk. Website operators must deploy either the 2026-oct release or Adobe's standalone patch to address the issue. Critically, both BlockStrap and StyleSmuggler require separate fixes, meaning administrators should retain the September VULN-39341 hotfix alongside the new patch. "BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well," Sansec cautioned.

Sansec has committed to publishing updates as soon as mass exploitation campaigns emerge, which the firm anticipates will occur in the coming weeks.