Cybersecurity
Sansec warns of Magento code-execution flaw
Sansec said CVE-2026-103849 in Adobe Commerce and Magento could let attackers run PHP code on store servers, and argued Adobe's priority 2 rating understated the need for rapid patching.
- Sansec said no attacks using CVE-2026-103849 had been observed, but it expected threat actors to exploit it.
- The firm said it identified four possible attack paths for the flaw in less than 24 hours.
- Adobe's October 13 bulletin said the issue was improper neutralisation in a template engine that could lead to arbitrary code execution.
- The flaw affected September versions of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3.
- Sansec said administrators needed the 2026-oct release or Adobe's isolated patch, and that BlockStrap and StyleSmuggler were separate fixes.
Sansec said it had not seen exploitation of CVE-2026-103849, but it expected attackers to work out an exploit. It said it had mapped four possible ways to abuse the flaw in less than a day, and said Adobe's priority 2 rating did not match the urgency.
Adobe's bulletin dated 13 October described the issue as a failure to neutralise special elements in a template engine. Sansec called the flaw BlockStrap and said it could let attacker-controlled content be processed again at the root level and run code.
Sansec said the problem exposed a gap left by the StyleSmuggler fix in the same email-template engine. Adobe's fix replaced generic processing with registered placeholders, and Sansec said a plain Composer install was not enough.
Sansec said site operators needed the 2026-oct release or Adobe's isolated patch. It also said the September VULN-39341 hotfix had to stay in place because BlockStrap and StyleSmuggler were separate fixes.
Named in this story
Companies
- Sansec
- warned about the flaw and analysed possible attack paths
- Adobe
- issued the bulletin and the fix
Products and systems
- CVE-2026-103849
- the vulnerability at issue
- Adobe Commerce
- one of the affected software lines
- Magento Open Source
- one of the affected software lines
- Adobe Commerce B2B
- another affected software line
- BlockStrap
- Sansec's name for the flaw
- StyleSmuggler
- the earlier fix Sansec compared it with
- VULN-39341
- the September hotfix Sansec said to keep in place
How the source tells it
The register was a security warning with a strong urgency frame, driven by predictions of imminent exploitation and a challenge to Adobe's severity rating.
- urgency it forecast near-term exploitation and said mass attack waves were expected soon
- alarm it paired a maximum-severity flaw with a challenge to Adobe's lower priority rating