Sansec is warning that a maximum-severity Magento and Adobe Commerce bug, dubbed BlockStrap (CVE-2026-103849), will likely be exploited soon even though no attacks have been seen yet.
The details
- It’s a second-pass template directive injection: attacker-controlled content in a child email template gets signed and processed again at the root level, running a smuggled
{{block}}directive. The result is arbitrary PHP code execution. - Affected: Adobe Commerce and Magento Open Source through 2.4.9 (September versions) and Adobe Commerce B2B through 1.5.3. Adobe’s bulletin went out October 13.
- Sansec found four potential attack paths in under 24 hours and disputes Adobe’s “priority 2” (patch within 30 days) rating: “anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time.”
What to do
Apply Adobe’s October 13 update now, not in 30 days. Sansec points out that StyleSmuggler, a bug of similar complexity, went from hotfix to mass exploitation in three days.
My take
That quote about AI agents and patch diffing is the new reality. The window between patch and exploit keeps shrinking, so “priority 2” ratings need rethinking.
