Vulnerabilities · Application Security
Critical BlockStrap flaw could let hackers take over Magento servers
A severe vulnerability in BlockStrap affects Magento and Adobe Commerce servers, letting attackers run code if unpatched. No attacks yet, but experts warn exploitation is likely.
Ross Grant3 min read
The short version
A serious security flaw has been found in software used by many online shops. If not fixed, hackers could take over affected websites. No attacks have happened yet, but experts say it is only a matter of time. Shop owners should update their software quickly.
What happened?
A critical vulnerability (CVE-2026-103849) in BlockStrap affects Magento and Adobe Commerce servers. Researchers say it could let hackers run code on these servers. No attacks have been seen yet, but experts warn that exploitation is likely soon.
What is the BlockStrap vulnerability?
A critical security flaw, tracked as CVE-2026-103849, has been found in BlockStrap, a component used by Magento and Adobe Commerce. According to BleepingComputer (opens in a new tab), researchers at Sansec say this vulnerability could let attackers run any code they want on affected servers. This type of attack is known as remote code execution, and it can give hackers full control over a website.
The flaw affects September versions of Adobe Commerce and Magento Open Source up to version 2.4.9, and Adobe Commerce B2B up to 1.5.3. Adobe has released a patch, but researchers warn that the official guidance to patch within 30 days may not be fast enough.
How does the attack work?
Sansec explains that the problem lies in how the email template engine processes special elements. The vulnerability is a second-pass template engine directive injection. This means attacker-controlled content in a child email template can be processed again at the root level, allowing a malicious {{block}} directive to run. In simple terms, an attacker could sneak dangerous instructions into an email template, which the system would then execute.
This flaw is similar to a previous issue called StyleSmuggler, which was quickly exploited after discovery. Sansec warns that, even though the attack path is complex, tools like AI agents could help attackers reverse-engineer the patch and create working exploits quickly.
What should administrators do?
Sansec urges website administrators not to rely on a standard Composer install to fix the issue. They must apply the October 2026 release or Adobe’s isolated patch. Administrators should also keep the September hotfix for StyleSmuggler in place, as both vulnerabilities need separate fixes.
Adobe rated this flaw as "priority 2", meaning they recommend patching within 30 days. However, Sansec believes this underestimates the risk, given how quickly similar flaws have been exploited in the past.
What is the risk if unpatched?
If attackers exploit this vulnerability, they could take control of e-commerce sites, steal customer data, or disrupt business operations. While no attacks have been seen yet, Sansec expects mass exploitation soon. E-commerce sites are frequent targets because they handle sensitive customer information and payment details.
What happens next?
Sansec will update the public if they detect active attacks. In the meantime, all Magento and Adobe Commerce administrators should patch as soon as possible. Waiting for the official 30-day window could leave sites exposed to attack.
Practical advice for readers
If you run an affected e-commerce site, check your software version and apply all available security patches immediately. Do not assume you are safe if you have only applied the Composer update. Ensure both the BlockStrap and StyleSmuggler fixes are in place. Monitor your site for unusual activity and stay alert for further updates from Adobe and security researchers.
Claimed vs confirmed
- Confirmed
Hackers could soon exploit CVE-2026-103849 to run code on Magento servers.
Sansec researchers and BleepingComputer report this risk, though no attacks have been observed yet.
- Confirmed
Adobe's 'priority 2' rating underestimates the urgency of this flaw.
Sansec publicly questions Adobe's rating, citing the risk of rapid exploitation.
The impact
- Money
- If exploited, affected businesses could face costs from incident response, lost sales, and possible regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of annual turnover.
- Reputation
- A breach could damage trust in affected e-commerce sites, especially if customer data is stolen or service is disrupted.
- Customers
- Customers risk having their personal and payment data stolen if attackers gain control of a shop. Shop owners should patch immediately to protect their users.
Why it matters
Magento and Adobe Commerce power many online shops. If this flaw is exploited, attackers could steal customer data, disrupt sales, or damage trust. Anyone running these platforms should patch immediately to protect their business and customers.
How does it work?
The flaw is a template engine directive injection. Attacker-controlled content in a child email template can be processed again at the root level, letting a malicious {{block}} directive execute code. This allows remote code execution on the server.
Key points
- Critical flaw affects Magento and Adobe Commerce servers
- Lets attackers run code if exploited, remote code execution
- No attacks seen yet, but experts expect them soon
- Patch immediately, do not wait for the 30-day window
- Both BlockStrap and StyleSmuggler fixes are needed
Sources
BleepingComputer
Reference
