Critical BlockStrap flaw lets hackers run code on Magento servers

{"title": "Critical BlockStrap Bug in Magento Could Enable Code Execution", "seo_title": "Magento BlockStrap flaw CVE-2026-103849 unpatched risk", "seo_description": "Critical: CVE-2026-103849 in Adobe Commerce/Magento through 2.4.9 and B2B 1.5.3 allows PHP code execution via template injection. Apply Oct 2026 patch now.", "body_md": "Security researchers at Sansec are sounding the alarm over a maximum-severity vulnerability, tracked as CVE-2026-103849 and nicknamed BlockStrap, that affects Adobe Commerce and Magento Open Source. The bug allows attackers to inject a hidden template directive into an email template, which then gets re-signed and executed with full privileges, letting them run arbitrary PHP code on the underlying server. While no real-world attacks have been spotted yet, Sansec says it already found four distinct ways to weaponize the flaw within a single day and expects criminals to follow suit quickly, especially since Adobe only assigned it a lower "priority 2" severity despite the serious impact. The vulnerability hits Magento Open Source and Adobe Commerce up to version 2.4.9 as well as Adobe Commerce B2B up to 1.5.3, and it exploits a gap left behind by an earlier fix for a related bug called StyleSmuggler. Store owners are advised to install Adobe's October 2026 release or the standalone patch, and to make sure the September StyleSmuggler hotfix remains applied too, since the two fixes address separate parts of the same template-engine weakness."}