Magento stores: a 10/10 vulnerability, and the fix has to be applied by hand

On September 7, Adobe shipped an emergency patch for StyleSmuggler, a flaw in Magento's email template engine. A month later, security firm Sansec says that patch left a gap in the same engine. Adobe closed it on October 13 in bulletin APSB26-153. Sansec named it “BlockStrap.”

The flaw, CVE-2026-103849, gets the maximum score of 10.0. According to Adobe, it allows arbitrary code execution without authentication. It affects Adobe Commerce and Magento Open Source up to version 2.4.9, Adobe Commerce B2B up to 1.5.3, and, according to Sansec, the Mage-OS fork up to 3.5.0. Adobe says it is aware of “no exploitation” at this stage.

Why Sansec thinks Adobe's priority is too low

Adobe rates the update “priority 2,” which corresponds to a recommended installation window of 30 days. Sansec disputes that rating. On October 14, the day after the patch, its team says it reproduced four ways to execute code. The company points out that StyleSmuggler went from an emergency patch to mass exploitation in three days, and that BlockStrap is of comparable complexity. According to Sansec, “anyone with an AI agent” can now derive an exploit from a patch.

The technical principle: attacker-controlled content in an email template is processed a second time, at the highest privilege level. A {{block}} directive slipped into that content then ends up being executed.

BlockStrap is not alone. The same bulletin fixes ten other flaws, including three that are also critical and exploitable without authentication (CVE-2026-92909 in the B2B version, CVE-2026-91013 and CVE-2026-100133).

The catch: an update that isn't really an update

A simple routine update may not be enough. According to Sansec, a standard Composer installation still pulls the vulnerable base version: you must apply the “2026-oct” release or Adobe's standalone patch. Second catch: the September StyleSmuggler patch (VULN-39341, CVE-2026-75650) is separate and must stay in place. Adobe also states this in its bulletin.

What to do

• Adobe Commerce 2.4.4 to 2.4.9: install the “2026-oct” release for your branch. Magento Open Source 2.4.7 to 2.4.9: same thing.
• Magento Open Source 2.4.6 or older: the bulletin provides no fixed version. Sansec advises upgrading to 2.4.7-p10 or later.
• Mage-OS: upgrade to 3.6.0, released on October 14 according to Sansec.
• Check that the patch is actually applied: Sansec says the resolveDeferredDirectives function must appear in vendor/magento/framework/Filter/Template.php (vendor/mage-os/framework/Filter/Template.php for Mage-OS). If it is missing, the patch is not in place. Also check the September patch: according to Sansec, Composer patching modules can skip part of a patch without making the installation fail.
• If you can't patch within the next few hours, put application-level filtering (a web application firewall) in front of the store and look for possible backdoors.

Critical flaws like this are quickly exploited: the WordPress plugin Bricksforge was attacked a few days after its flaw was published. Sansec says it will update its analysis as soon as it detects waves of attacks. For those who are late, the window could be short.