Insights
BlockStrap (CVE-2026-103849): the CVSS 10.0 Magento RCE Adobe fixed in APSB26-153
BlockStrap is the name Sansec gave to CVE-2026-103849, a template injection flaw in Magento Open Source and Adobe Commerce that lets an attacker run code on the server without logging in. Adobe rates it Critical with a CVSS score of 10.0 and fixed it on 13 October 2026 in security bulletin APSB26-153. As of 16 October 2026, neither Adobe nor Sansec has seen it used against live stores, but Sansec reproduced four working attack routes within 24 hours of the patch and expects attackers to do the same. If your store is on 2.4.4 to 2.4.9 and you have not applied the October 2026 isolated patch, treat this as this week's job, not this month's.
CVE-2026-103849, CVSS 10.0, no login needed. The September hotfix stays in place; the October patch is a separate fix.
What BlockStrap is
Adobe describes CVE-2026-103849 as "Improper Neutralization of Special Elements Used in a Template Engine" (CWE-1336), leading to arbitrary code execution, with no authentication required. Its CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and a changed scope. Adobe credits the researcher vozec with the find.
Sansec, who analysed the fix, call it "a second-pass directive injection, like StyleSmuggler". Magento's email template engine renders directives such as block and var, written inside double curly braces. The September hotfix for StyleSmuggler (VULN-39341) signs trusted directives so smuggled ones are ignored. BlockStrap gets round that: attacker-controlled data in a child template can still be signed, then rescanned at the root level, where a smuggled block directive runs inside Magento's rendering. Adobe's October fix replaces that generic root-level rescan with registered placeholders.
Two things follow from that. First, BlockStrap and StyleSmuggler are separate bugs with separate fixes, and you need both: Adobe's bulletin says the CVE-2026-75650 hotfix must be applied in addition to the October update, and Adobe's KB note says the hotfix "is not in the October Isolated patch and must be applied separately." Second, the October patch is the only fix. Adobe lists no workaround.
Which Magento versions are affected
From Adobe's bulletin, every supported line is affected, and every line that was current in September 2026 counts as vulnerable until the October isolated patch is on it:
| Product | Affected | Fixed |
|---|---|---|
| Adobe Commerce | 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4, at the 2026-sep level and earlier | 2.4.10-alpha1, and the 2026-oct isolated patch for each of 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 |
| Adobe Commerce B2B | 1.5.3, 1.5.2, 1.4.2, 1.3.4 and 1.3.3, at the 2026-sep level and earlier | 1.5.4-alpha1, and the 2026-oct patch for each line |
| Magento Open Source | 2.4.9, 2.4.8, 2.4.7 and 2.4.6, at the 2026-sep level and earlier | 2.4.10-alpha1, and the 2026-oct isolated patch for 2.4.9, 2.4.8 and 2.4.7 only |
Three points matter for Open Source stores in particular.
- 2.4.9 is affected. A fresh 2.4.9 from Composer is the base release, with none of the 2026 isolated patches. Adobe has not shipped a 2.4.9-p1; the September and October fixes exist only as isolated patch files, and Adobe's KB note says no Composer packages are published for this release. Sansec make the same point: a plain Composer install still has the vulnerable base version.
- Open Source 2.4.6 is listed as affected with no fix. Adobe's bulletin names Magento Open Source 2.4.6 in the affected table and gives fixed versions only for 2.4.7, 2.4.8 and 2.4.9. Adobe's KB says Open Source patch downloads are available only for 2.4.7 or later. Standard support for 2.4.6 ended on 11 August 2026; the extended and security-only periods in Adobe's lifecycle table are written for Adobe Commerce. If you run Open Source 2.4.6, the upgrade is now the patch. See Magento 2.4.6 end of life.
- Adobe Commerce 2.4.4 to 2.4.6 get a patch, but downloading it needs your Composer keys.
Is BlockStrap being exploited?
Not that anyone has published, as of 16 October 2026.
- Adobe's bulletin says it "is not aware of any exploits in the wild for any of the issues addressed in this update."
- Sansec's analysis, published 15 October 2026, says "No exploitation observed yet", and that they will update it when they identify mass attack waves.
- CVE-2026-103849 is not in CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.10.15). StyleSmuggler, CVE-2026-75650, was added on 8 September 2026.
Adobe rated the bulletin priority 2, which in Adobe's scheme means patch within 30 days. Sansec disagree with that window. In their words: "we managed to reproduce four different attack routes within 24 hours, and expect threat actors to do the same." The precedent is StyleSmuggler: Sansec's first confirmed exploitation was on 4 September 2026 and Adobe's hotfix followed three days later, on 7 September. With BlockStrap the order is reversed, the patch exists before the attacks, so the 30-day window is a ceiling, not a target.
How to apply the BlockStrap patch
Adobe's October fixes are isolated patch files, not a new release and not a Composer update. From Adobe's KB note:
- Be on the latest security-only release for your line first. That is 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18. Adobe tests the isolated fixes only against those versions.
- Apply earlier monthly isolated patches in release order. The September 2026 patch comes before October's. The Commerce Version Tool used for checking ships in the July 2026 isolated patch, so if `vendor/bin/patch-status` is missing, apply the July CE patch first.
- Download the October ZIP for your line: `2-4-9-oct-2026.zip`, `2-4-8-p5-oct-2026.zip`, `2-4-7-p10-oct-2026.zip`, `2-4-6-p15-oct-2026.zip`, `2-4-5-p17-oct-2026.zip` or `2-4-4-p18-oct-2026.zip`. Each ZIP can contain several patch files; apply only the ones that match your installed components (CE, then EE, then B2B), previous month first.
- Keep, or apply, the StyleSmuggler hotfix VULN-39341. It is not inside the October patch. Adobe's September notice also told merchants to rotate the encryption key and every credential that may have been encrypted with it.
- Verify. Run `php vendor/bin/patch-status`. The Commerce Version Tool reports each CVE as PROTECTED, VULNERABLE or UNKNOWN. Adobe Commerce on cloud infrastructure gets the fix through the latest cloud-patches update instead; the KB warns that applying the isolated patch on top of that can fail.
Test on staging, then apply to production in a window with a rollback plan. Adobe's patches touch the template engine, which transactional emails, newsletters and some page builders rely on, so send a test order and a password reset after patching.
The other ten fixes in APSB26-153
BlockStrap is the headline, but the bulletin fixes 11 CVEs: five Critical, five High and one Moderate.
| CVE | Type | Impact | Severity | Login needed |
|---|---|---|---|---|
| CVE-2026-103849 | Template injection (CWE-1336) | Code execution | Critical 10.0 | No |
| CVE-2026-92909 | Incorrect authorization (B2B) | Code execution | Critical 9.8 | No |
| CVE-2026-91013 | Stored XSS | Privilege escalation | Critical 9.3 | No |
| CVE-2026-100133 | Stored XSS | Privilege escalation | Critical 9.3 | No |
| CVE-2026-92464 | Improper input validation | Code execution | Critical 9.1 | Admin |
| CVE-2026-92911 | Stored XSS | Code execution | High 8.7 | Yes |
| CVE-2026-95631 | Improper input validation | File system write | High 8.7 | Admin |
| CVE-2026-92908 | Incorrect authorization (B2B) | Security feature bypass | High 8.3 | Yes |
| CVE-2026-92922 | Stored XSS | Privilege escalation | High 8.1 | Admin |
| CVE-2026-92910 | Incorrect authorization (B2B) | Security feature bypass | High 7.2 | No |
| CVE-2026-95630 | Improper input validation | Security feature bypass | Moderate 4.3 | Yes |
Four of the eleven need no login at all. The October patch closes all of them at once, which is one more reason not to wait. Our bulletin timeline lists every Adobe Commerce bulletin since 2020.
What this means for EveryHost customers
- On our Fully Managed plan we apply Magento security patches for you: staging first, then production in an agreed window, with a rollback plan. If a patch conflicts with custom code, we stop and hand it to your developer.
- On Standard and Managed, your developer applies the Magento patch on the staging copy and we coordinate production. The Managed plan's monthly vulnerability check flags a missing October patch.
- Sentinel is log-based monitoring that blocks at the server firewall. It is not a WAF and does not inspect template directives, so it does not stop a BlockStrap request. The patch does.
- If you want help deciding what to apply in which order, open a ticket with your current version and the output of `php vendor/bin/patch-status`.
Sources
All accessed 16 October 2026.
- Adobe security bulletin APSB26-153, 13 October 2026
- Adobe KB: Security update available for Adobe Commerce, APSB26-153, updated 15 October 2026
- Sansec: BlockStrap, Magento and Adobe Commerce RCE (CVE-2026-103849), 15 October 2026
- Sansec: StyleSmuggler, updated 14 September 2026
- Adobe KB: Urgent action required, APSB26-146 hotfix, updated 21 September 2026
- NVD: CVE-2026-103849
- CISA Known Exploited Vulnerabilities catalog, version 2026.10.15
- Adobe Commerce lifecycle policy, updated 18 September 2026
Frequently asked questions
Want the October patch applied for you?
Our Fully Managed plan applies Magento security patches on staging first, then to production in an agreed window, with a rollback plan.