Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849) ยท updates https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849 BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days. en Thu, 15 Oct 2026 00:00:00 GMT Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849): Sansec names the bug BlockStrap after reproducing four code-execution routes within 24 hours of the patch, and warns exploitation is likely soon; no attacks on live stores yet. https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849 https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-15-e9ac2c7c Thu, 15 Oct 2026 00:00:00 GMT critical <p><a href="https://sansec.io/research/blockstrap-magento-rce">Source</a></p> Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849): Adobe publishes APSB26-153 fixing CVE-2026-103849 and other critical, high and medium bugs; not aware of exploits. https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849 https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-13-1bd57d44 Tue, 13 Oct 2026 00:00:00 GMT critical <p><a href="https://www.adobe.com/trust/security/products/commerce/apsb26-153.html">Source</a></p>