# Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849) · pwn.watch > BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days. Page: https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849 · generated 2026-10-25T09:28:03.652Z ## Status - Severity: critical · status: live · patch: patched - Product: Adobe Commerce, Magento Open Source, Adobe Commerce B2B - Started: 2026-10-13 - CVEs: CVE-2026-103849 - Affected: Adobe Commerce / Magento Open Source through 2.4.9 (September 2026 builds); Adobe Commerce B2B through 1.5.3 - Fixed in: 2.4.9-2026-oct or the October 2026 isolated patch (APSB26-153); public patches for 2.4.7-p10, 2.4.8-p5, 2.4.9; Mage-OS 3.6.0 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/feed.xml - JSON Feed: https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849.json - This file: https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/llms.txt ## Updates (newest first) - 2026-10-15: Sansec names the bug BlockStrap after reproducing four code-execution routes within 24 hours of the patch, and warns exploitation is likely soon; no attacks on live stores yet. (https://sansec.io/research/blockstrap-magento-rce) - 2026-10-13: Adobe publishes APSB26-153 fixing CVE-2026-103849 and other critical, high and medium bugs; not aware of exploits. (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) ## Fix brief # Security brief: Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849) Source: https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849 · status: live · severity: critical · updated Oct 24, 2026, 06:40 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days. Severity detail: CVSS 10.0; unauthenticated RCE; no in-the-wild exploitation reported yet (Adobe priority 2) - Product: Adobe Commerce, Magento Open Source, Adobe Commerce B2B - CVE / advisory ids: CVE-2026-103849 ## Affected versions - Adobe Commerce / Magento Open Source through 2.4.9 (September 2026 builds) - Adobe Commerce B2B through 1.5.3 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 2.4.9-2026-oct or the October 2026 isolated patch (APSB26-153); public patches for 2.4.7-p10, 2.4.8-p5, 2.4.9 - Mage-OS 3.6.0 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Apply the October 2026 isolated patch or upgrade to 2.4.9-2026-oct, and keep the September StyleSmuggler (VULN-39341, CVE-2026-75650) hotfix, which the October patch does not include. Mage-OS: upgrade to 3.6.0. Sansec's check: `grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php` returns 0 on a vulnerable install. Sansec says a plain Composer install alone may not apply the fix; verify after deploying. ## Latest updates - Oct 15, 2026: Sansec names the bug BlockStrap after reproducing four code-execution routes within 24 hours of the patch, and warns exploitation is likely soon; no attacks on live stores yet. - Oct 13, 2026: Adobe publishes APSB26-153 fixing CVE-2026-103849 and other critical, high and medium bugs; not aware of exploits. ## Advisories - [Security update available for Adobe Commerce | APSB26-153](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) (Adobe) - [CVE-2026-103849](https://www.cve.org/CVERecord?id=CVE-2026-103849) (CVE.org) ## Write-ups & news - [BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)](https://sansec.io/research/blockstrap-magento-rce) - [Critical BlockStrap flaw lets hackers run code on Magento servers](https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/) --- Machine-readable: https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.