Magento BlockStrap flaw rated 10.0 needs a manual patch

Magento BlockStrap flaw rated 10.0 needs a manual patch

15 October 2026: Adobe has fixed CVE-2026-103849, a CVSS 10.0 flaw in Adobe Commerce and Magento Open Source that lets an attacker who is not logged in run code on the store server, in bulletin APSB26-153 of 13 October. The fix does not arrive through an ordinary Composer install: stores must apply the October release or Adobe's isolated patch, and Sansec, which named the bug BlockStrap, says it reproduced four separate routes to code execution within 24 hours.

Not yet independently verified. Adobe's bulletin APSB26-153 answered our request with an access-denied page, so the score, versions and 13 October date come from Sansec's write-up. Sansec reported no exploitation as of 15 October. We will update this when it can be confirmed, and remove this note.

Affected and fixed versions

According to Sansec, the affected versions are:

• Adobe Commerce up to and including 2.4.9
• Adobe Commerce B2B up to 1.5.3
• Magento Open Source up to and including 2.4.9
• Mage-OS up to 3.5.0

Adobe's public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9. Patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade to 2.4.7-p10 or later. Mage-OS 3.6.0, released on 14 October, contains the fix. Adobe lists the downloads per version in its knowledge-base article ka-49323.

A second break in the email template engine

BlockStrap is the second CVSS 10.0 flaw in Magento's email template engine in six weeks, after StyleSmuggler (CVE-2026-75650). Both are second-pass directive injections: data an attacker controls in a child template can be signed and rescanned at the root, where a smuggled {{block}} directive runs. Adobe's October patch replaces that rescan with registered placeholders.

The two fixes are separate. Adobe's patch registry does not list the September hotfix VULN-39341 as a prerequisite, so a store that skipped it remains open to StyleSmuggler after applying the October patch.

How to check a deployment

Sansec gives two checks to run in the Magento root even when a deploy reported no errors, because Composer patch plugins can skip a hunk silently:

• grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php should not print 0.
• On 2.4.8-p5, grep -c QUOTED_LOCAL_PART_PATTERN vendor/magento/framework/Validator/EmailAddress.php should not print 0; if it does, apply 248p5-2026-10-002-CE, which Adobe published on 14 October after the first zip left out a change for CVE-2026-91013.

The patch also creates an empty file named 976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228 in the Magento root, a lock-file naming bug (magento/magento2#41535) that is safe to delete.

Why the priority rating is disputed

Adobe rated the fix priority 2, meaning patch within 30 days, and Sansec says Adobe reserves priority 1 for flaws it knows are exploited. Sansec disagrees, pointing out that StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days and that BlockStrap is of similar complexity. Stores that took a month to apply the September hotfix are the ones this argument is about. Our small-business e-commerce category lists 11 platforms.

Sources

• Sansec: BlockStrap, critical Magento and Adobe Commerce RCE (CVE-2026-103849), 15 October 2026
• Adobe: security bulletin APSB26-153 (access denied to our request, 2026-10-19), 13 October 2026
• iThome: Adobe Commerce flaw coverage, 19 October 2026