Adobe Commerce · Disclosed

Adobe patches critical BlockStrap RCE in Magento; manual patch required

Oct 12, 2026 · 1 min read

BlockStrap (CVE-2026-103849) is a template engine injection in Adobe Commerce and Magento Open Source, scored CVSS 10.0, that gives unauthenticated attackers remote code execution. Adobe shipped the fix on October 13, 2026 in bulletin APSB26-153, which requires a manual patch; Sansec reproduced four attack routes within 24 hours but had observed no exploitation on live stores as of October 15. Apply the October patch now and keep the StyleSmuggler hotfix (VULN-39341), which the October patch does not include.

By HIFY Radar newsroom Updated 10/26/2026 01:29 PM Get this every day →← Back to the feed 4 sources

CriticalVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A critical flaw dubbed BlockStrap (CVE-2026-103849) lets attackers without login run arbitrary code on Adobe Commerce and Magento Open Source store servers. Adobe released the fix on October 13, 2026 in bulletin APSB26-153, but it requires a manual patch. As of October 15, Sansec had observed no attacks on live stores.

Why it matters

A compromised store exposes customer data and hands the attacker full control of the server. Sansec notes the flaw matches StyleSmuggler in severity, which went from hotfix to mass exploitation in three days, and fresh Composer installs remain vulnerable. Adobe rated it priority 2 with a 30-day window, a timeline Sansec calls risky.

What to do

Apply the October patch (APSB26-153) or upgrade to the 2.4.9-2026-oct build today, without waiting for Adobe's 30-day window. Also install the September StyleSmuggler hotfix (VULN-39341), which the October patch does not include, and verify the patch actually applied. If you cannot patch within hours, Sansec says Sansec Shield blocks the attack at the HTTP layer.

For the technical team

CVE: CVE-2026-103849
Affected: Adobe Commerce, Magento Open Source, Adobe Commerce B2B · Adobe Commerce and Magento Open Source through 2.4.9 (September 2026 builds); Adobe Commerce B2B through 1.5.3; Mage-OS through 3.5.0. A plain Composer install stays on the vulnerable base version.
Exploitation: No exploitation observed on live stores as of October 15, 2026, per Sansec. Sansec reproduced four code-execution routes within 24 hours of the patch and expects threat actors to do the same. Adobe rated it priority 2 (patch within 30 days) because it knows of no attacks, stated by Adobe in the Magento community Slack, per Sansec.
Fix: 2.4.9-2026-oct build or the October 2026 isolated patch (APSB26-153); public patches for 2.4.7-p10, 2.4.8-p5 and 2.4.9; Mage-OS 3.6.0, released October 14, upgrading the mage-os/product-community-edition metapackage. Patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 require an Adobe Commerce license; Happy Horizon published third-party backports, with no warranty from Sansec. The patch replaces the generic rescan with registered placeholders. Keep the StyleSmuggler hotfix VULN-39341, installed before the October patch. Patch check: grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php (0 means the fix is missing); hotfix check: vendor/bin/magento-patches -n status | grep "39341\|Status". Downloads are listed in Adobe article ka-49323.
Vector: Component: Magento email template engine (framework/Filter/Template.php). Type: second-pass directive injection. The StyleSmuggler hotfix signs trusted directives, but attacker-controlled data in a child template can still be signed and rescanned at the root level, where a smuggled {{block}} directive runs arbitrary PHP inside Magento's rendering. Exploitable without authentication, with the store reachable.
More details: Credited to vozec, per Sansec. Second critical break in the email template engine in six weeks, after StyleSmuggler (CVE-2026-75650, hotfix on 2026-09-07). Sansec timeline: Oct 13 Adobe publishes APSB26-153; Oct 14 Sansec reproduces four routes, ships Shield rules and Mage-OS 3.6.0 ships; Oct 15 analysis published, no exploitation observed. The October patch mistakenly creates an empty lock file in the Magento root, 976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228 (SHA-256 hash of /var/.regenerate.lock); it can be deleted (bug magento/magento2#41535). The first 2.4.8-p5 patch omitted the CVE-2026-91013 fix in EmailAddress.php; Adobe released 248p5-2026-10-002-CE on Oct 14; check with grep -c QUOTED_LOCAL_PART_PATTERN vendor/magento/framework/Validator/EmailAddress.php. Twig payloads with registerUndefinedFilterCallback are not BlockStrap; callbacks to bxss.me come from the Acunetix scanner. Composer patch plugins can skip a hunk without failing the build; run eComscan to look for backdoors.