Critical BlockStrap flaw lets hackers run code on Magento servers
Critical BlockStrap flaw in Magento and Adobe Commerce allows arbitrary code execution.
Run Adobe?
Get an email when a reviewed story names Adobe, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability, dubbed BlockStrap (CVE-2026-103849), has been discovered in Magento and Adobe Commerce, potentially allowing attackers to execute arbitrary PHP code on store servers. While attacks have not yet been observed, security firm Sansec warns that threat actors are likely to develop exploits quickly, especially with AI assistance. The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3, and requires both this fix and the previous StyleSmuggler hotfix for complete protection.
The lesson from this incident
Full lessonThe BlockStrap vulnerability (CVE-2026-103849) exposes Magento and Adobe Commerce servers to arbitrary PHP code execution, giving attackers the potential to fully compromise e-commerce environments and steal sensitive customer and payment data. The flaw affects a wide range of versions and requires two separate hotfixes to be fully remediated, increasing the complexity of the patching process and the risk of incomplete remediation. Because no active exploitation has yet been observed, defenders have a narrow window to act before threat actors — potentially aided by AI-assisted exploit development — weaponize the vulnerability. E-commerce platforms are high-value targets due to the financial and personal data they handle, making rapid patch deployment critical.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-103849