E-commerce security firm **Sansec** has issued a stark warning regarding **CVE-2026-103849**, a critical vulnerability impacting **Magento Open Source** (up to 2.4.9) and **Adobe Commerce** (up to 2.4.9), as well as **Adobe Commerce B2B** (up to 1.5.3). ### The 'BlockStrap' Threat Dubbed 'BlockStrap', this flaw allows for arbitrary PHP code execution on affected store servers. **Sansec** researchers rapidly identified four potential attack paths within 24 hours of discovery, leading them to anticipate imminent exploitation by threat actors. ### Underestimated Severity? **Adobe** rated **CVE-2026-103849** as a 'priority 2' vulnerability, suggesting a patch timeline of 30 days. However, **Sansec** strongly disputes this assessment, arguing that the perceived complexity of the attack path is a false comfort. "The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," **Sansec** stated. They drew parallels to the **StyleSmuggler** vulnerability, which escalated from a hotfix to mass exploitation within three days, despite similar complexity. ### Technical Deep Dive **Adobe's** bulletin, published on October 13, describes **BlockStrap** as an improper neutralization of special elements within a template engine. **Sansec** elaborates that it functions as a second-pass template engine directive injection. This allows attacker-controlled content in a child email template to be signed and reprocessed at the root level, ultimately executing a smuggled `{{block}}` directive. **Sansec's** analysis further reveals that **BlockStrap** exploits a gap left by the previous **StyleSmuggler** fix within the same email-template engine. ### Patching and Mitigation **Adobe's** fix addresses the vulnerability by replacing generic processing with registered placeholders, thereby preventing exploitation. However, **Sansec** emphasizes that a standard Composer install is insufficient to mitigate the risk entirely. Website administrators must apply the 2026-oct release or **Adobe's** isolated patch. Crucially, **Sansec** advises, "BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well." **Sansec** will provide further updates as they monitor for mass attack waves, which they expect to materialize soon.