Security notice

Magento or Adobe Commerce store? A flaw rated 10 out of 10 lets strangers run code on your server. Patch now.

Last updated: Sunday, October 25, 2026, 12:57 AM ETStatus: Fix released. No attacks reported yet. Patch now, not in 30 days.

On October 13, 2026, Adobe fixed CVE-2026-103849, a flaw in Magento Open Source and Adobe Commerce that security firm Sansec has named BlockStrap. Adobe rates it critical, 10.0 out of 10, the highest score there is, and says no login is needed to exploit it. Sansec says it lets an attacker run their own code on the store's server. Adobe gave the patch priority 2, which means within 30 days. Sansec disagrees: it found four working ways to run code within 24 hours and expects attackers to do the same. No attacks on live stores have been reported yet. The fix is a separate October patch, and stores also need September's StyleSmuggler hotfix. If you run a Magento or Adobe Commerce store, ask your developer today whether both are installed.

What happened

The flaw. Adobe describes CVE-2026-103849 as an "Improper Neutralization of Special Elements Used in a Template Engine" that can lead to arbitrary code execution, with no login needed. It scores 10.0 out of 10 on the CVSS 3.1 scale. Sansec says the flaw is in Magento's email template engine and that "an unauthenticated attacker runs arbitrary PHP on the store server." (Adobe, CVE record, Sansec)
The second break in six weeks. Sansec says BlockStrap is the second critical flaw in the same email template engine in six weeks, after StyleSmuggler (CVE-2026-75650) in September. It says BlockStrap exposes a gap left by the StyleSmuggler fix, and that the two need separate fixes. (Sansec, BleepingComputer)
Adobe and Sansec disagree on urgency. Adobe rated the update priority 2 and said it was "not aware of any exploits in the wild." Sansec says Adobe reserves priority 1 for flaws it knows are being exploited. Sansec questions the rating: "anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time." It adds that "StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity." (Adobe, Sansec)
Four routes in 24 hours. Sansec says it reproduced four different ways to run code within 24 hours of Adobe's patch. (Sansec, BleepingComputer)
Test code is public. On October 18, a security researcher published a test lab that reproduces the core flaw without a login. The researcher's own notes say it does not show a full takeover of a standard store. We do not link to it.
No attacks reported yet. Sansec said on October 15 that it had not seen BlockStrap attacks on live stores and would update its post when it sees mass attack waves. As of October 25, its post still reports none. (Sansec)
Installing the usual way may not be enough. Sansec says a plain Composer install still has the vulnerable base version, so stores need the October 2026 release or Adobe's separate patch file. (Sansec, Adobe KB ka-49323)

Who should worry

Any store server running an affected version without the October patch. An attacker who can run code on your server can change your checkout, read customer data and plant code that hides from you.

Magento Open Source 2.4.7, 2.4.8 or 2.4.9 without the October 2026 patch. (Adobe, CVE record)
Adobe Commerce 2.4.4 through 2.4.9, and Adobe Commerce B2B through 1.5.3, without the October 2026 patch. (Adobe, CVE record)
Magento Open Source 2.4.6 or older. Sansec says Adobe has no public patch for these versions. The October patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 need an Adobe Commerce license. Sansec says to upgrade to 2.4.7-p10 or later. (Sansec)
Mage-OS up to 3.5.0. Sansec says Mage-OS 3.6.0, released October 14, contains Adobe's fix. (Sansec)
A developer or agency runs Magento stores for you or for your clients.

What to do now

Do these today.

Ask the question. Send the message below to your developer, agency or host. You need a clear yes or no: is the October 2026 APSB26-153 patch installed and confirmed working, and is the September StyleSmuggler hotfix still in place?
Install the October patch now, not in 30 days. Adobe's fixed versions are labeled "2026-oct", for example 2.4.9-2026-oct. Adobe also offers a separate patch file for each supported version. (Adobe, Adobe KB ka-49323)
Keep the September hotfix. Adobe says to apply the hotfix for CVE-2026-75650 in addition to this update, and that it is not included in the October patch file. Sansec calls it VULN-39341 and says to install it before the October patch. (Adobe, Adobe KB ka-49323, Sansec)
Check that the patch really applied. Sansec warns that deploy tools can skip part of a patch without reporting an error. See the check under Technical steps. (Sansec)
Check for other open doors. A separate criminal campaign is planting code in Magento CMS blocks through older flaws. It is not linked to BlockStrap, but the same check of your store is worth doing now. See our Magento CMS block notice.
If the answer is "I don't know", that is not a no. Ask them to check.

What to send your developer, agency or host

Adobe security bulletin APSB26-153 (October 13, 2026) fixes CVE-2026-103849, "BlockStrap", a CVSS 10.0 template engine injection in Magento Open Source and Adobe Commerce that Adobe says needs no authentication and Sansec says gives remote code execution. Adobe rated it priority 2, but Sansec reproduced four exploit routes within 24 hours and advises patching now. Please confirm today that our store has the 2026-oct release or Adobe's October isolated patch for our version, that the September StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) is still installed, and that grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php does not return 0. If we are on Magento Open Source 2.4.6 or older, please plan an upgrade to 2.4.7-p10 or later. Sources: Adobe APSB26-153, Sansec.

Technical steps

Step 1. Check your version

bin/magento --version

Adobe's separate patch files are tested only on the latest security release of each line, and each month's patch builds on the ones before it, so apply earlier monthly patches first, in order. Sansec lists the public October patches for Magento Open Source as 2.4.7-p10, 2.4.8-p5 and 2.4.9. (Adobe KB ka-49323, Sansec)

Step 2. Apply the fix

Install the 2026-oct release or download the October patch for your version from Adobe's knowledge base article. Sansec says the September StyleSmuggler hotfix must be in place first, and that patch may report line offsets in Preview.php and AbstractTemplate.php, but the changes still apply. On Adobe Commerce on Cloud, Adobe says the latest cloud-patches update already contains the fix, and applying the separate patch on top of it can make the install fail. On Mage-OS, upgrade the mage-os/product-community-edition package to 3.6.0. (Adobe KB ka-49323, Sansec)

Step 3. Confirm both fixes are present

grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php
vendor/bin/magento-patches -n status | grep "39341\|Status"

Sansec says a result of 0 from the first command means the BlockStrap fix is missing. On Mage-OS, check vendor/mage-os/framework/Filter/Template.php instead. The second command shows whether the StyleSmuggler hotfix is applied. (Sansec)

Step 4. On 2.4.8-p5, check the corrected patch

Sansec says Adobe corrected the 2.4.8-p5 patch file on October 14 for another bug in the same bulletin. Both versions contain the BlockStrap fix. If grep -c QUOTED_LOCAL_PART_PATTERN vendor/magento/framework/Validator/EmailAddress.php prints 0, apply 248p5-2026-10-002-CE. (Sansec)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. No BlockStrap attacks on live stores have been reported. It means a serious flaw has a fix, and unpatched stores are exposed until it is installed. (Sansec)

Can EverThread tell me if I am affected?

No. EverThread checks your website from the outside, the way a browser sees it. We do not test for this flaw, and our scan cannot see your Magento version, which patches are installed or whether one applied correctly. Your developer or host can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Adobe says priority 2. Do we have 30 days?

Adobe's priority 2 means patching within 30 days. Sansec says not to wait, because it built four working attack routes in 24 hours and the last flaw like this, StyleSmuggler, went from patch to mass attacks in three days. We agree with Sansec: patch now. (Sansec)

Is BlockStrap how the Magento CMS block campaign got in?

No. Sansec has not linked that campaign to BlockStrap. It says earlier break-ins point to older file upload flaws, PolyShell and SessionReaper. See our Magento CMS block notice.

Where can I follow official updates?

Adobe's security bulletin APSB26-153 and its patch download article have the official details. Sansec says it will update its BlockStrap post when it sees attacks.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Adobe: Security update available for Adobe Commerce, APSB26-153, October 13, 2026
Adobe: Security update available for Adobe Commerce, APSB26-153 (KB ka-49323), updated October 16, 2026
CVE Program: CVE-2026-103849, checked October 25, 2026
Sansec: BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849), October 15, 2026, checked October 25, 2026
BleepingComputer: Critical BlockStrap flaw lets hackers run code on Magento servers, October 16, 2026