# Critical 'BlockStrap' Flaw Threatens Adobe Commerce and Magento Open Source

> A severe vulnerability in Adobe Commerce and Magento Open Source, dubbed "BlockStrap," allows unauthenticated attackers to execute arbitrary code, posing an immediate risk to e-commerce platforms.

By PrimaryBrief newsroom · Published 2026-10-16T22:58:26.133719Z
Canonical: https://primarybrief.com/article/critical-blockstrap-flaw-threatens-adobe-commerce-and-magento-open-source-3b5f2db4

Businesses utilizing Adobe Commerce and Magento Open Source are at severe and immediate risk due to a critical template engine vulnerability, CVE-2026-103849, known as "BlockStrap," which carries a maximum CVSS v3.1 score of 10.0 [1][3][4]. This flaw enables unauthenticated attackers to execute arbitrary code on affected servers [1][3][4].

This vulnerability poses a direct threat to the integrity and security of e-commerce operations. A successful exploit could lead to complete server compromise, the exfiltration of sensitive data, deployment of webshells, and lateral movement within a business's online environment [3]. Given the ease of exploitation, unpatched systems are highly susceptible to malicious activity.

## What the records show

Adobe released security update APSB26-153 on October 13, 2026, to address "BlockStrap" and ten other vulnerabilities [1][6][10][11][12][13]. The flaw, CVE-2026-103849, is classified as an improper neutralization of special elements (CWE-1336) [3][4]. It features a low-complexity, network-based attack vector that requires no user interaction or elevated privileges [1][3][4]. At the time of the APSB26-153 release, Adobe reported no known in-the-wild exploitation of "BlockStrap" [1]. However, Sansec researchers reproduced four distinct exploit routes within 24 hours of the patch's availability, indicating a high likelihood of imminent exploitation [2]. The affected versions include various 2.4.x-2026-sep and earlier releases of Adobe Commerce and Magento Open Source, as well as 1.x.x-2026-sep and earlier versions of Adobe Commerce B2B [6][13].

## The timeline

Adobe released security update APSB26-92 on August 11, 2026 [5]. Exploitation of a separate critical vulnerability, CVE-2026-75650, known as "StyleSmuggler," began on September 4, 2026 [7]. Adobe then released APSB26-146 on September 7, 2026, which included a hotfix for CVE-2026-75650 [8]. On October 12, 2026, Zynovo published an article discussing issues with insufficient patching [9]. The fix for "BlockStrap" (CVE-2026-103849) arrived with the APSB26-153 security update on October 13, 2026 [1][6][10][11][12][13]. Two days later, on October 15, 2026, Sansec researchers successfully reproduced four different exploit methods for "BlockStrap" [2]. Warnings about imminent exploitation of the "BlockStrap" flaw were issued on October 16, 2026 [1][14][15][16].

## What changed and for whom

Adobe assigned "BlockStrap" a Priority 2 rating, recommending users apply the patch within 30 days [13]. Merchants must update their installations to the October 2026 releases, such as 2.4.4-2026-oct for Adobe Commerce and 2.4.10-alpha1 or later October 2026 releases for Magento Open Source [1][6][13]. Isolated patches are also available for specific versions [1]. It is important to note that APSB26-153 does not include the hotfix for the "StyleSmuggler" vulnerability (CVE-2026-75650), requiring users to apply that hotfix separately and rotate encryption keys and associated credentials [1]. While no official workarounds exist, temporary measures include restricting public exposure of storefronts and administrative interfaces, and blocking external access to relevant API endpoints through Web Application Firewall (WAF) rules [1].

## What the subject has said publicly

Adobe has recommended that users apply the APSB26-153 patch within 30 days of its release [13]. The company stated that it had no knowledge of any in-the-wild exploitation of the "BlockStrap" vulnerability at the time of the security update's publication [1].

## What we could not confirm

We could not confirm if the temporary mitigation measures suggested by researchers are officially endorsed by Adobe as workarounds [1]. The exact number of Adobe Commerce and Magento Open Source installations that remain unpatched and vulnerable to "BlockStrap" is also unclear. We could not confirm if "BlockStrap" (CVE-2026-103849) has been exploited in the wild since Adobe's October 13, 2026, security update.

## Evidence cited
1. Critical BlockStrap flaw lets hackers run code on Magento servers (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
2. Sansec: BlockStrap (CVE-2026-103849): Four routes to code execution within 24 hours (sansec.io) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHywLyK2UGihEmu2HLZbxjX1YvneEPyaJOIkvoOh9LOl34VV4SQc416VBSlKDhsRv2NJgeBvb0xKmM9a-nK_lVh5CVyXks92QUVFK_1rP1oOa1NlG49M15yS%20M4HK6NK2r1fzDuG4m8XxzJxBtc=
3. CVE-2026-103849 Critical Template Engine Injection in Adobe Commerce and Magento Open Source (ionix.io) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHupEA7E_iJZTFl-jxIJMaarQ9aK-gKwVDTdSzEhVQt4fEh_6Ot5NfWZvv4XyrR70F__nwU8A8jwTmVksfrRYsJmJmpJ5xg2eF88GnS37WB07Pfn7AntyLMsSWjv4-bqzFc7X6rXTizBsg2gu_j9g==
4. CVE-2026-103849: Critical Arbitrary Code Execution in Adobe Commerce (cycognito.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHoucf8SZV4g-hoRMP4TlKZ1yZocDXaBc0xT10Ydvi6U090BQJc1dlnP31HaOhOGFpqlTVXwjbQkdAmZ6GghQp80N9JawUnwzuXWxRZzA5Ej6w-tx-Lq0S-Oj653BuxqhzJupW0E3-IxTcqLTlJO26UZuw3s80CG9ZZxZikpFfZ1RZWWMXhDYS1YYpaUdUDYpw8C4cGVXrjwRcHlAySyVRrEGTbkbD1eJ8Y1OTmfKfJYknr
5. Security update available for Adobe Commerce | APSB26-92 (adobe.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGmLvZdEK84gHmG-VrFU7BaYayQHze-q3TZ2ht7kH9u1gziJDgWJ5uIAH_s4Oy51mkNNmlsnL6G8I0cAoUfs3fLuHANNbWxlmj3ubWOyq7x3zG_SSOAjlyesTdJ3g42GFOIUYdYKCgFrEb4gQTAmR3Qgsvey474AkHj8zgJwnewUg==
6. Adobe Commerce Security Update - October 2026 (adobe.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHxQZnZeCGgCbya2dTIR_VRj9YD0778JDCVAd0ZPUuR9mRNa5h6MhDv7dpL-FzwPA9MlLYZhD6bauHOI5Nhctd2w1xayEXCR9Fzg7KHsn_PA9kT8tcRVi8KeoX7a_mNOaB7-PWegsN4wDUH9Q8zLyGl2t5tJz8cSv22gUbdPPeSQJBQ5SSMoQ6dMDGvCQ1L
7. Adobe Warns of Critical Magento Flaw (CVE-2026-75650) Exploited in the Wild (thehackernews.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGrj6Gqq-jkXHiiCet7Bw53eXwt_ckoLt-xp2QH0tGkuEDpVnAzNeMUPjvYkDaY58WHUh-NyDweLwGOEGlP3xnDvo5o8gbsXJCQkVA9JyRcb29g-Is261cmiU0peYcWN_AYmDCzyRbiyTgno1g1lmMFOepDwGBbjWHakamcEn2hGA==
8. Security update available for Adobe Commerce | APSB26-146 (adobe.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGBVCLuGk58zcke2uVC3X8GNDG-JopyWdm-UnWOQAOe5c4SABHSh-PQ_A_XexdOhSLUum4_MLsSiUI1j7bApauvOKErSyuGRFUoJESL_gvLbIU2kyW2mAJkshMLJIDTTPXc9wchmloiKF6pdKatnxzygFMJ8MdEQQLq753W8TNMV80=
9. Adobe Commerce/Magento Security in 2026: Why Installing Patches Is No Longer Enough (zynovo.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGQrGaa8tbDBzGAXHoxt835c-9u2O9x5iJmdmRUF1JOkbVqzWA0PnyQ1sMIGNR60Feru6UyttKnnV_9bG348bRPdgqE9HPYxQd2vVdsnTUooc1VC19mVn-ZDzeniKIaKTY8bqx5GqT-TkfQFyMVoNfYwE2srGHj3C2-
10. APSB26-153: Critical Security Update for Adobe Commerce and Magento Open Source (meetanshi.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFSRssZXDGRBNbTIqvg70CnaKh6ekEIyHq__pM2HGbY3GvEJ1g3xFzMsTHWBIu2e7B1HwlkGvIPNuUhpa5qR_qF69bqELrN2i6S1FYvrzTd-JQGlZX41RbNr0H0n7lhh10SQWGyl-HzuyjjBNuoA0eQpUFmjL7_2fKpvw==
11. Adobe Releases Critical Security Updates for Adobe Commerce and Magento Open Source – APSB26-153 (zynovo.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEcJ_QWBeMly5HL2vlDNuvEEH6yuX84dzf0ljVn1JONylzWmimGCM9SECHcZrP5b9XGmUem43qOxyFALbmZu0deGBPQZqQP5qmyp4GDBvJmN93caWCOM0DRwkWs_Jy1zb7aKpkwqTOA_AQV4XmBcz1uAEGjxIjYwq0A6jp1lgK8UIKKU2yZ
12. Adobe releases security update APSB26-153 fixing 11 vulnerabilities in Adobe Commerce and Magento Open Source (freepressrelease.io) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDlEy9nJV3DmDl-NFGb7NjThAxb_bWpEviA0j8jcWr8KjkZljxKoKriPP37kZv5RtF-tBcg0DzhISlMQyqS-o39R4z_sPw_BAA-IfbA59o1mCVEh53MX_HWiClFIFSyygSR15sXgRaAXICpN56b6CBgwELqxN3xTBkj8byaPT54b5DZm4HhREEcppJoT_R2CeLX4DwhlpOjmwUtzCvV6TdFKbXaZ98MWERMqTMNh6mlpbW3prZCl1pu-2f2g==
13. Security update available for Adobe Commerce | APSB26-153 (adobe.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQECZNLzCE0kLut7QIw0HNlubu3svF5mrHjETNgsmgMProkhYpMM051gdijEVm8VuWT0_2BOis4staACDshW3HMOF63a2mGcLzI3GmL6JZol7-ARacHBQH3qvsmuHWClZNXihPJixYb-RpiY8yXQiyIQpdZh0EHqN-kd8EvWzLl-reE=
14. Critical BlockStrap flaw lets hackers run code on Magento servers (reddit.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEHyzH7C56zqXejKcmL2TvHz-zN3l0ou6jOysUvHTuMiiBkGMrjaS3jJ8703fehcmv5TEYXgF8W0IV8J48KbaPxSWXtoc-uATEW6dJg212b27cTraQazvPo52mFQxYv6tc1304R6LxMS5rQTS0hzPyBRicrC6J1fcyAx-fJYD0jO4R4aJDRlk0_J72qjuVrZ_qda1b17vDrmEagKrpGHEwGctEu
15. Critical BlockStrap flaw lets hackers run code on Magento servers (bleepingcomputer.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFxLpLHfjVNUUcKvXKUMCoXP3wGuffXcngDSzTN6I5e9t-2PfNSCPrs5G-6UTUFvdIzoSyE862GrvY-Riozg04lu5gTVtDo1fopgm1dMSeAz9LdWF_xpcMHthkdVg==
16. Critical BlockStrap flaw lets hackers run code on Magento servers (reddit.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHMzkIEjwB4brinqUEaekerd5kRMQFV93-72itLd5ncAdW-Rg7nDyjiSW3gCYwhGf6X4MeyyNF8wKjVB8PH7CtnS8kniRM6wx6zOF8Ox--VoO2Yw-spqDc5rYblOryqUQJ-BQ==