--- title: Critical BlockStrap flaw lets hackers run code on... description: A maximum-severity vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento, Adobe Commerce, and Adobe Commerce B2B, allowing attackers to execute... canonical: https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical BlockStrap flaw lets hackers run code on Magento servers | daily.dev og:description: A maximum-severity vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento, Adobe Commerce, and Adobe Commerce B2B, allowing attackers to execute... og:url: https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn og:image: https://api.daily.dev/og/posts/Xr6KNHZgN.png og:image:alt: Critical BlockStrap flaw lets hackers run code on Magento servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical BlockStrap flaw lets hackers run code on Magento servers **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary A maximum-severity vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento, Adobe Commerce, and Adobe Commerce B2B, allowing attackers to execute arbitrary PHP code on store servers via a second-pass template engine directive injection in the email-template system. E-commerce security firm Sansec says no exploitation has been observed yet but expects it soon, criticizing Adobe's 'priority 2' (30-day patch) rating given that a similar prior flaw, StyleSmuggler, went from disclosure to mass exploitation in three days. Store administrators are urged to apply Adobe's isolated patch or the October release, and keep the earlier StyleSmuggler hotfix in place as well since a plain Composer install is insufficient. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the BlockStrap vulnerability in Magento and Adobe Commerce? BlockStrap, tracked as CVE-2026-103849, is a maximum-severity flaw in Magento and Adobe Commerce's email template engine that lets attackers inject a second-pass template directive, causing attacker-controlled content in a child email template to be signed and reprocessed at the root level, executing a smuggled {{block}} directive for arbitrary PHP code execution. It affects September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. _Store admins tracking Magento security patches can follow emerging RCE threats like this on daily.dev._ ### How do I fully patch the BlockStrap and StyleSmuggler Magento vulnerabilities? A plain Composer install is not enough; administrators must apply the 2026-oct release or Adobe's isolated BlockStrap patch, and also keep the September VULN-39341 StyleSmuggler hotfix in place, since BlockStrap and StyleSmuggler are separate fixes that both need to be applied together. _Teams patching e-commerce stacks can track fast-moving Magento fixes like these on daily.dev._ ### Why is Adobe's priority 2 rating for the BlockStrap Magento flaw considered risky? Security firm Sansec argues the priority 2 rating, which allows a 30-day patch window, understates the urgency because a similarly complex prior flaw called StyleSmuggler went from a priority 1 hotfix to mass exploitation in just three days, and anyone with an AI agent can reverse-engineer Adobe's patch into a working exploit in a short time. _Developers deciding how fast to patch critical CVEs can monitor exploitation timelines on daily.dev._ ## Similar posts on daily.dev - [Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw](https://daily.dev/posts/over-250-magento-stores-hit-overnight-as-hackers-exploit-new-adobe-commerce-flaw-vp64hkl5b) · The Hacker News · 0 upvotes · 0 comments - [Hackers exploit critical Adobe Commerce flaw to hijack customer accounts](https://daily.dev/posts/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts-cke5dsk3l) · BleepingComputer · 0 upvotes · 0 comments - [Adobe Just Released Another Magento Security Patch. Here’s Why You Shouldn’t Ignore It.](https://daily.dev/posts/adobe-just-released-another-magento-security-patch-here-s-why-you-shouldn-t-ignore-it--qgl9vnvmq) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#magento](https://daily.dev/tags/magento) [View this post on daily.dev](https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical BlockStrap flaw lets hackers run code on Magento servers","url":"https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn"},"datePublished":"2026-10-16T20:05:20.300Z","dateModified":"2026-10-16T21:20:44.932Z","description":"A maximum-severity vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento, Adobe Commerce, and Adobe Commerce B2B, allowing attackers to execute...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa55cf7d639e2684d2f375f93517646?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa55cf7d639e2684d2f375f93517646?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,magento","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical BlockStrap flaw lets hackers run code on Magento servers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-xr6knhzgn#faq","mainEntity":[{"@type":"Question","name":"What is the BlockStrap vulnerability in Magento and Adobe Commerce?","acceptedAnswer":{"@type":"Answer","text":"BlockStrap, tracked as CVE-2026-103849, is a maximum-severity flaw in Magento and Adobe Commerce's email template engine that lets attackers inject a second-pass template directive, causing attacker-controlled content in a child email template to be signed and reprocessed at the root level, executing a smuggled {{block}} directive for arbitrary PHP code execution. It affects September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. Store admins tracking Magento security patches can follow emerging RCE threats like this on daily.dev."}},{"@type":"Question","name":"How do I fully patch the BlockStrap and StyleSmuggler Magento vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"A plain Composer install is not enough; administrators must apply the 2026-oct release or Adobe's isolated BlockStrap patch, and also keep the September VULN-39341 StyleSmuggler hotfix in place, since BlockStrap and StyleSmuggler are separate fixes that both need to be applied together. Teams patching e-commerce stacks can track fast-moving Magento fixes like these on daily.dev."}},{"@type":"Question","name":"Why is Adobe's priority 2 rating for the BlockStrap Magento flaw considered risky?","acceptedAnswer":{"@type":"Answer","text":"Security firm Sansec argues the priority 2 rating, which allows a 30-day patch window, understates the urgency because a similarly complex prior flaw called StyleSmuggler went from a priority 1 hotfix to mass exploitation in just three days, and anyone with an AI agent can reverse-engineer Adobe's patch into a working exploit in a short time. Developers deciding how fast to patch critical CVEs can monitor exploitation timelines on daily.dev."}}]} ```