CriticalCVECVE-2026-103849
Critical BlockStrap flaw lets hackers run code on Magento servers
BleepingComputer·Source published ·1 min read
What happened?
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
Key details
- BlockStrap exploits email-template engine injection with signed directives
- Adobe rates flaw priority 2 despite high severity risk
- StyleSmuggler fix left gap that BlockStrap exploits
- Plain Composer install insufficient to fully remediate risk
Affected
- Magento Open Source and Adobe Commerce through 2.4.9
- Adobe Commerce B2B through version 1.5.3
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.