Security researchers are warning store administrators to patch a critical vulnerability in Magento and Adobe Commerce before attackers get there first. The flaw, tracked as CVE-2026-103849 and dubbed BlockStrap, could allow hackers to execute arbitrary PHP code on vulnerable e-commerce servers.

According to e-commerce security firm Sansec, no active exploitation has been observed yet, but the company expects attacks soon. Researchers say they identified four distinct potential attack paths tied to the flaw in less than 24 hours of analysis, a sign that working exploits could emerge quickly once threat actors turn their attention to it.

The vulnerability affects September versions of Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3. Adobe’s bulletin, published on October 13, describes it as improper neutralization of special elements in a template engine, resulting in arbitrary code execution.

Sansec explains that BlockStrap is a second-pass template engine directive injection. It allows attacker-controlled content placed in a child email template to be signed and reprocessed at the root level, smuggling in a malicious block directive that ultimately executes.

A gap left by a previous fix

Notably, Sansec says BlockStrap exploits a gap left behind by the fix for a related flaw known as StyleSmuggler. Adobe’s patch for BlockStrap replaces generic template processing with registered placeholders to close that gap, but the two issues require separate fixes.

“BlockStrap and StyleSmuggler are separate fixes. You need both, so keep the September VULN-39341 hotfix in place as well,” Sansec advised, noting that a standard Composer install alone will not resolve the risk. Administrators should apply the 2026-oct release or Adobe’s isolated patch.

Sansec also pushed back on Adobe’s “priority 2” severity rating, which recommends patching within 30 days. The firm pointed to StyleSmuggler as a cautionary precedent, noting that flaw went from a priority 1 hotfix to mass exploitation in just three days, and that BlockStrap carries similar complexity.

“The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time,” Sansec stated. The firm said it will issue updates if it detects mass exploitation attempts, which it expects could happen soon.