BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable.
BlockStrap is the second critical break in Magento's email template engine in six weeks. It has the same CVSS 10.0 score as StyleSmuggler and the same impact: an unauthenticated attacker runs arbitrary PHP on the store server.
Adobe patch: CVE-2026-103849
Adobe published APSB26-153 on October 13. The most critical issue is BlockStrap, a template engine injection at CVSS 10.0, found by vozec.
A plain Composer install still has the vulnerable base version, so apply the 2026-oct release or Adobe's isolated patch.
BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well.
Builds upon StyleSmuggler
BlockStrap is a second-pass directive injection, like StyleSmuggler. The September VULN-39341 hotfix signs trusted directives, but attacker-controlled data in a child template can still be signed and rescanned at the root level, where a smuggled {{block}} directive runs inside Magento's rendering. Adobe's October patch replaces that generic rescan with registered placeholders.
Four routes to code execution in 24 hours
The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time. That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.
What merchants should do
Recall your team from vacation and start patching today. If you cannot patch within hours, Sansec Shield blocks BlockStrap at the HTTP layer, with rules live for all Shield stores. Run eComscan to flag the missing patch and check for backdoors.
We will update this article when we identify mass attack waves.
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
PolyShell: unrestricted file upload in Magento and Adobe Commerce
SessionReaper attacks have started, 3 in 5 stores still vulnerable
SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)
Adobe patches critical Magento admin takeover via injection
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
Scan your store now for malware & vulnerabilities
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
