On October 13, 2026 Adobe published security bulletin APSB26-153, covering 11 vulnerabilities in Adobe Commerce and Magento Open Source. The most serious is CVE-2026-103849, dubbed BlockStrap by researchers at Sansec: unauthenticated arbitrary code execution on the store server, with the maximum CVSS score of 10.0.
What happened
The flaw is in the email template engine. Attacker-controlled content in a child template gets signed and then processed again at the root level, which lets a {{block}} directive through and runs PHP code on the server. According to Sansec, BlockStrap exploits a gap left by the StyleSmuggler fix in the same engine.
The same bulletin fixes CVE-2026-92909 in Adobe Commerce B2B (CVSS 9.8, also unauthenticated), two stored XSS flaws rated 9.3 and seven more vulnerabilities.
Why not wait 30 days
Adobe rated the bulletin Priority 2, which means installing it within 30 days. Sansec disagrees: its researchers found four attack paths within a day, and with an AI agent the patch can be turned into a working exploit fairly quickly. Sansec points to StyleSmuggler, a flaw of similar complexity that went from hotfix to mass exploitation in three days. As of October 22 no attacks on BlockStrap have been seen, and it is not in the CISA KEV catalog.
Who is at risk
- Adobe Commerce 2.4.4–2.4.9 and Magento Open Source 2.4.6–2.4.9, every build up to and including September.
- Adobe Commerce B2B 1.3.3–1.5.3.
What to do now
- Apply Adobe's October isolated patch for your version (for example
2-4-9-oct-2026.zipor2-4-8-p5-oct-2026.zip), or use Cloud Patches on Adobe Commerce Cloud. Adobe has not published Composer packages with these fixes, so a regularcomposer updatewill not close the vulnerability. Check that the patch is in place withphp vendor/bin/patch-status. - Isolated patches go on in order: first every required patch from earlier months for your version, then the October one.
- Keep the September StyleSmuggler hotfix (CVE-2026-75650) in place. BlockStrap and StyleSmuggler are separate fixes, and you need both.
- On October 16 Adobe updated the isolated patch for Magento Open Source 2.4.8-p5 with an additional validation change. The original file already contained the main protection, but Adobe recommends reverting it and applying a freshly downloaded copy.
- If you suspect the store has already been compromised, rotate the encryption key and related credentials: integration tokens, payment gateway keys and automation credentials.
We have been working with Magento for more than ten years. We will apply the October fixes on a staging environment, check checkout and transactional emails, roll out to production with a rollback plan and check the store for signs of compromise.
Sources: Adobe security bulletin APSB26-153, BleepingComputer on BlockStrap, bulletin breakdown by Meetanshi.