Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849)

BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days.

Why this severity: CVSS 10.0; unauthenticated RCE; no in-the-wild exploitation reported yet (Adobe priority 2)

Started

Oct 13, 2026

CVE

CVE-2026-103849

• PHP
• Adobe
• #Magento
• #Adobe Commerce
• RCE