BlockStrap in Magento and Adobe Commerce: RCE via email templates

On 13 October 2026 Adobe published security bulletin APSB26-153, fixing CVE-2026-103849 in Adobe Commerce and Magento Open Source. The vulnerability, dubbed BlockStrap by researchers at Sansec, a company specialising in e-commerce security, allows arbitrary code execution on the online store’s server. In the National Vulnerability Database (NVD) it carries the maximum score, CVSS 10.0, assigned by Adobe.

On 19 October the Centre for Cybersecurity Belgium (CCB) published an advisory urging organisations to update Adobe Commerce and Magento Open Source immediately. The advisory text could not be retrieved at the time of writing: the technical details that follow come from NVD and, via BleepingComputer, from Sansec’s analysis.

What we know

• CVE: CVE-2026-103849, weakness CWE-1336 (improper neutralisation of special elements used in a template engine).
• Severity: CVSS 3.1 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: exploitable over the network, without credentials and without user interaction, with a scope change. NVD currently lists the entry as «undergoing analysis».
• Impact: according to the NVD description, arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session. BleepingComputer, reporting Sansec’s findings, describes execution of arbitrary PHP code on store servers.
• Affected versions: according to BleepingComputer, the September versions of Adobe Commerce and Magento Open Source up to 2.4.9 and Adobe Commerce B2B up to 1.5.3. The exact list of versions and patches is in Adobe’s APSB26-153 bulletin.
• Exploitation: as of 16 October, the date of the BleepingComputer article, Sansec had not observed any attacks. The available sources do not report any later exploitation.

How the attack works

According to Sansec’s analysis as reported by BleepingComputer, BlockStrap is a second-pass directive injection in the email template engine. Attacker-controlled content placed in a «child» email template is signed and processed again at the root level, so that a smuggled {{block}} directive gets executed.

Sansec links BlockStrap to StyleSmuggler, an earlier vulnerability in the same email template engine: BlockStrap exploits a gap left by the StyleSmuggler fix. Adobe’s fix replaces the generic processing with registered placeholders, which prevents exploitation.

In the MITRE ATT&CK classification the scenario falls under exploitation of an internet-facing application (T1190, Exploit Public-Facing Application).

The sources disagree on urgency

Adobe rated the issue priority 2, which means updating within 30 days. Sansec disputes this rating: the attack path is complex, but according to the researchers anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time. Sansec says it identified four potential attack paths in less than 24 hours and points out that StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, with similar complexity. It therefore expects attack waves soon.

The CVSS vector published by NVD also indicates low attack complexity (AC:L), whereas Sansec describes the path as complex. The CCB advisory asks, in its very title, for organisations to patch immediately.

The references in the NVD entry also include a public GitHub repository dedicated to the vulnerability, with «blockstrap-lab» in its name. We have not analysed it, but the availability of public technical material is one more reason not to wait.

Why it matters for European and Italian companies

Magento and Adobe Commerce power many online stores, in Italy too, often run by agencies or external hosting providers. Code execution on the store server gives access to orders, customer data and site pages, including the payment pages.

If an attack leads to a personal data breach, GDPR obligations apply, including notifying the supervisory authority within 72 hours when there is a risk to individuals. Online marketplaces are among the digital providers covered by NIS2: for them, the handling of this vulnerability should be documented, and any significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Take an inventory of your Magento Open Source, Adobe Commerce and Adobe Commerce B2B installations, including test instances and those managed by agencies or providers, with their exact versions.
2. Apply the October 2026 security release (2026-oct) or Adobe’s isolated patch. According to Sansec, a plain Composer install is not enough to remove the risk.
3. Keep the StyleSmuggler fix as well: Sansec warns that these are two separate fixes and you need both, so the September VULN-39341 hotfix must stay in place.
4. If you cannot update right away, ask your provider how to protect the store until the patch is applied, and monitor the server more closely than usual.
5. Look for signs of compromise: new or modified PHP files in the site directory, recently created administrator accounts, unexpected changes to email templates (including in the database) and anomalous requests in the web server logs. The sources have not published indicators of compromise.
6. Follow updates from Adobe and Sansec: Sansec has said it will report the first waves of attacks.

How ARXDOME helps

ARX Expose shows your company’s public services and the products it recognises, which helps you find exposed online stores. ARX Shield lists open vulnerabilities by machine and by package on servers with the agent, and ARX Trace file changes tell you what changed and where: together they help you see whether new files have appeared on the store server since the vulnerability was disclosed.

Last updated: 19 October 2026