Sansec Warns Maximum-Severity Flaw in Magento and Adobe Commerce Could Be Exploited Soon

Sansec warned on October 16 that a maximum-severity vulnerability in Magento and Adobe Commerce could soon be exploited, urging administrators to apply the latest fix. The flaw, tracked as CVE-2026-103849 and named BlockStrap, could allow attackers to execute arbitrary PHP code on store servers.

Sansec said attacks exploiting BlockStrap have not yet been observed, but threat actors are expected to find a way to exploit it. The security firm identified four potential attack paths involving CVE-2026-103849 in less than 24 hours.

According to Adobe's bulletin published on October 13, the flaw is an improper neutralization of special elements used in a template engine that leads to arbitrary code execution. Sansec said Adobe's priority 2 rating does not reflect the danger and urgency in this case.

The vulnerability impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. Sansec said a plain Composer install is not enough and administrators must apply the 2026-oct release or Adobe's isolated patch.

Sansec also said the September VULN-39341 hotfix should remain in place, noting that BlockStrap and StyleSmuggler are separate fixes requiring both. StyleSmuggler, an earlier vulnerability in the same email-template engine, went from a priority 1 hotfix to mass exploitation in three days.

Sansec said it will provide an update when it detects mass attack waves, which it expects soon.