Sansec finds four BlockStrap attack paths in a day

CVE-2026-103849 is a maximum-severity flaw in Magento and Adobe Commerce that lets an attacker run arbitrary PHP on the store server. Adobe published the bulletin on October 13 and rated it priority 2, meaning patch within 30 days. The e-commerce security firm Sansec, which named the bug BlockStrap, found four separate attack paths in under 24 hours and says that rating is wrong.

No attacks have been seen in the wild yet. Sansec expects that to change, and its reasoning is specific: StyleSmuggler, a related bug in the same email-template engine, went from a priority-1 hotfix to mass exploitation in three days. “The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time,” the firm says, putting BlockStrap at similar complexity.

Adobe describes the flaw as improper neutralization of special elements in a template engine, leading to arbitrary code execution. Sansec’s description is more useful. BlockStrap is a second-pass directive injection: attacker-controlled content sits in a child email template, gets signed, and is then processed again at the root level, where a smuggled {{block}} directive executes. The signing step is what makes it work, because content that would be rejected on its own passes once it rides in on a legitimately signed template.

This is the gap StyleSmuggler’s fix left open. It is the same engine and the same class of problem, patched once but still reachable by a different route. Adobe’s new fix replaces the generic template processing with registered placeholders, so arbitrary directives no longer resolve.

The affected versions are the September releases of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3.

A plain Composer install does not cover this. Administrators need the 2026-oct release or Adobe’s isolated patch. Because BlockStrap and StyleSmuggler are separate fixes, the September VULN-39341 hotfix also has to stay in place; applying one does not supersede the other.

Sansec says it will post an update when it detects mass attack waves, which it expects soon.