A maximum-severity flaw in the Magento email template engine lets unauthenticated attackers run arbitrary PHP code on store servers. The vulnerability, tracked as CVE-2026-103849 and named BlockStrap, was fixed by Adobe on October 13, but security firm Sansec warns that the patch needs to be applied manually and that mass attacks could start soon.
What is BlockStrap
BlockStrap is a second-pass template engine directive injection. Attacker-controlled data inside a child email template gets signed and rescanned at the root level, where a smuggled {{block}} directive executes inside Magento’s rendering process. The result is remote code execution with a CVSS score of 10.0, found by researcher vozec and detailed by Sansec.
The flaw is the second critical break in Magento’s email template engine in six weeks. It sits on top of a gap left by the StyleSmuggler fix from September. The earlier hotfix signs trusted directives, but data in a child template could still be re-signed and processed again at the root level. Adobe’s October patch replaces that generic rescan with registered placeholders.
Affected versions
- Adobe Commerce 2.4.9 and earlier
- Adobe Commerce B2B 1.5.3 and earlier
- Magento Open Source 2.4.9 and earlier
- Mage-OS 3.5.0 and earlier (fixed in 3.6.0, released October 14)
Why Sansec disputes Adobe’s rating
Adobe lists BlockStrap as priority 2, meaning a patch window of 30 days. Sansec disagrees. The firm reproduced four different attack routes within 24 hours of studying the patch and advisory. Its researchers point out that StyleSmuggler went from a hotfix to mass exploitation in three days, and BlockStrap is of similar complexity. Their argument is blunt: anyone with an AI agent can reverse-engineer the patch into working exploits in a short time.
So far, Sansec says it has not seen BlockStrap attacks on live stores. That quiet period is not expected to last.
How to protect your store
A plain Composer install is not enough, because it can leave the vulnerable base version in place. Admins should apply the 2026-oct release or Adobe’s isolated patch. BlockStrap and StyleSmuggler are separate fixes, so the September VULN-39341 hotfix must stay in place as well.
One more catch: the public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5, and 2.4.9. Patches for 2.4.4, 2.4.5, and 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older have to upgrade to 2.4.7-p10 or later. Adobe lists the downloads for each version in KB article ka-49323. If you run Mage-OS, upgrade the mage-os/product-community-edition metapackage to 3.6.0.
Store owners who cannot patch within hours should look at HTTP-layer blocking rules and run a malware scan to check for backdoors. With the festive sale season live on most Indian stores, a defaced or skimming checkout is the last thing any merchant needs.
FAQ
What is the BlockStrap vulnerability in Magento?
BlockStrap (CVE-2026-103849) is a CVSS 10.0 template engine injection in Magento and Adobe Commerce. It lets an unauthenticated attacker execute arbitrary PHP code on the store server through a smuggled directive in email templates.
Has BlockStrap been exploited yet?
Sansec has not observed attacks on live stores so far. However, the firm reproduced four attack routes within 24 hours and expects threat actors to do the same.
How do I patch my Magento store for CVE-2026-103849?
Apply the 2026-oct release or Adobe’s isolated patch from the APSB26-153 bulletin. A plain Composer update is not sufficient. Keep the September VULN-39341 hotfix for StyleSmuggler in place too.
Is Magento Open Source 2.4.6 patched for BlockStrap?
No. The public patches cover 2.4.7-p10, 2.4.8-p5, and 2.4.9. Stores on 2.4.6 or older need to upgrade, since older patches require an Adobe Commerce licence.
Is Mage-OS affected by BlockStrap?
Yes, up to Mage-OS 3.5.0. Version 3.6.0, released on October 14, carries Adobe’s fix. Upgrade the mage-os/product-community-edition metapackage to get it.
