Adobe Commerce
Security incidents tagged Adobe Commerce. Newest first.
1 Adobe Commerce incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 11
- Longest quiet run: 9 days (Oct 16–Oct 24)
- Patched
Adobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849)
BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days.
Adobe Commerce, Magento Open Source, Adobe Commerce B2BSince Oct 13, 2026
