Sansec warns that Magento and Adobe Commerce flaw CVE-2026-103849 could let attackers run PHP code on store servers. Patch now.
Online stores running Magento or Adobe Commerce face a newly disclosed flaw that could let attackers run their own code on store servers. The bug is tracked as CVE-2026-103849 and nicknamed "BlockStrap". Adobe published a security bulletin about it on October 13. E-commerce security firm Sansec has since warned that Adobe's own urgency rating understates the danger. No attacks have been seen so far, but Sansec expects criminals to start using the bug soon. It found four possible attack paths in less than a day of analysis.
Adobe's October 13 bulletin describes the problem in the technical language of vulnerability databases. It calls it an "improper neutralization of special elements used in a template engine" that can lead to arbitrary code execution. Put simply, the shopping platform does not properly clean certain input before handing it to the system that builds pages and emails. That gap could let an attacker get the server to run instructions of the attacker's choosing.
Adobe gave the issue a "priority 2" rating. In Adobe's scheme, that means administrators are advised to patch within 30 days. Sansec challenged that rating publicly. Its researchers said they identified four potential ways to attack the flaw in under 24 hours. In their view, that pace shows how quickly a determined attacker could turn the patch into a working attack.
Sansec also pointed to a recent example in the same software. A previous flaw, which Sansec calls "StyleSmuggler", received a priority 1 hotfix from Adobe. According to Sansec, it went from that fix to mass exploitation in three days. Sansec considers BlockStrap to be of similar complexity. The firm said it will publish an update when it detects large-scale attack waves, which it expects to happen soon.
According to Sansec's reporting, the vulnerability affects:
The ITVedas CVE database, which draws on NVD and CISA data, does not yet list specific affected versions for this CVE. The version ranges above therefore come from Sansec's analysis as reported. Administrators should check them against Adobe's bulletin.
Magento and Adobe Commerce power online shops, so the people directly at risk are merchants and the IT teams who run their storefronts. The sources do not single out any particular industry or region. Shoppers are affected indirectly. A compromised store server could put customer data and transactions at risk, although the sources do not describe any specific customer impact for this flaw.
To understand BlockStrap, it helps to know what a template engine is. Online stores send many automated emails, such as order confirmations and password resets. Rather than writing each one from scratch, the platform uses templates. These are pre-written messages with placeholders that are filled in automatically, for example with the customer's name or order number. The template engine is the part of the software that reads these templates and replaces the placeholders with real content.
Templates can also contain directives. These are special instructions wrapped in double curly braces that tell the engine to perform an action. One of these is the {{block}} directive, which tells the engine to insert a component of the store's software into the message. Directives are meant to be written by the store's developers, not supplied by outsiders.
Sansec describes BlockStrap as a "second-pass" directive injection. In plain terms, the engine can process content more than once. Content an attacker controls can end up inside a smaller "child" email template. That content can then be treated as trusted and processed again at the top level of the template. During that second pass, a {{block}} directive hidden in the attacker's content can be executed. The result is that the attacker could run PHP code on the server. PHP is the programming language Magento is written in.
Sansec says BlockStrap exploits a gap left behind by the earlier fix for StyleSmuggler, which affected the same email-template engine. Adobe's new patch changes how this processing works. Instead of handling content in a generic way, it uses a fixed set of registered placeholders. That blocks the route the attack relies on. ITVedas is not publishing further technical detail about how the flaw could be triggered.
On paper, this is as serious as vulnerabilities get. The verified CVE record gives CVE-2026-103849 a CVSS score of 10.0, rated Critical. CVSS, the Common Vulnerability Scoring System, is the industry-standard 0-to-10 scale for rating flaws. The record states that exploitation does not require any user interaction. It also states that the "scope is changed", meaning a successful attack can reach beyond the vulnerable component itself. The weakness is classified as CWE-1336, the category for template engine injection flaws.
As of the verified data, the flaw is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. KEV is the US government's list of bugs confirmed to be used in real attacks. Sansec likewise says it has not yet observed any exploitation.
The main disagreement is over urgency. Adobe's priority 2 rating suggests a 30-day patching window. Sansec argues that is too relaxed, even though it acknowledges that the attack path is complex. Its reasoning is that modern tools make complexity less of a barrier. Sansec warned that "anyone with an AI agent can reverse-engineer the patch" into working exploits in a fairly short time. Given the StyleSmuggler precedent, where three days separated the fix from mass attacks, Sansec's position is that store operators should not wait a month.
For store administrators and developers:
For everyday shoppers:
ITVedas analysis: BlockStrap shows how one patch can leave a gap that later becomes a new vulnerability. Merchants should treat the CVSS 10.0 score and the StyleSmuggler precedent as stronger signals than Adobe's 30-day guidance, and patch within days rather than weeks.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →