On October 13, 2026 Adobe published security bulletin APSB26-153, covering 11 vulnerabilities in Adobe Commerce and Magento Open Source. The most serious is CVE-2026-103849, dubbed BlockStrap by researchers at Sansec: unauthenticated arbitrary code execution on the store server, with the maximum CVSS score of 10.0.
What happened
The flaw is in the email template engine. Attacker-controlled content in a child template gets signed and then processed again at the root level, which lets a {{block}} directive through and runs PHP code on the server. According to Sansec, BlockStrap exploits a gap left by the StyleSmuggler fix in the same engine.
The same bulletin fixes CVE-2026-92909 in Adobe Commerce B2B (CVSS 9.8, also unauthenticated), two stored XSS flaws rated 9.3 and seven more vulnerabilities.
Why not wait 30 days
Adobe rated the bulletin Priority 2, which means installing it within 30 days. Sansec disagrees: its researchers found four attack paths within a day, and with an AI agent the patch can be turned into a working exploit fairly quickly. Sansec points to StyleSmuggler, a flaw of similar complexity that went from hotfix to mass exploitation in three days. As of October 22 no attacks on BlockStrap have been seen, and it is not in the CISA KEV catalog.
Who is at risk
- Adobe Commerce 2.4.4–2.4.9 and Magento Open Source 2.4.6–2.4.9, every build up to and including September.
- Adobe Commerce B2B 1.3.3–1.5.3.
What to do now
- Update to the October build of your branch (for example 2.4.9-2026-oct or 2.4.8-2026-oct; for B2B, 1.5.3-2026-oct and its siblings), or apply Adobe's isolated patch. According to Sansec, a plain Composer install is not enough, so check that the fix is actually in place.
- Isolated patches go on in order: first every required patch from earlier months for your version, then the October one.
- Keep the September StyleSmuggler hotfix (CVE-2026-75650) in place. BlockStrap and StyleSmuggler are separate fixes, and you need both.
- On October 16 Adobe updated the isolated patch for 2.4.8-p5. If you applied it before that date, apply it again.
- Adobe recommends rotating the encryption key and related credentials: integration tokens, payment gateway keys and automation credentials.
We have been working with Magento for more than ten years. We will apply the October fixes on a staging environment, check checkout and transactional emails, roll out to production with a rollback plan and check the store for signs of compromise.
Sources: Adobe security bulletin APSB26-153, BleepingComputer on BlockStrap, bulletin breakdown by Meetanshi.