BlockStrap, a 10.0-severity flaw in Magento and Adobe Commerce: what companies with online shops should check this week

Key points for company leaders

This article reflects information available on the morning of 26 October 2026 (Japan time). Whether the flaw is being attacked can change quickly. For the latest, check the announcements listed in the sources at the end.

• What happened

  On 13 October Adobe fixed vulnerabilities in Adobe Commerce, Adobe Commerce B2B and Magento Open Source in security bulletin APSB26-153. The most serious, CVE-2026-103849, can allow arbitrary code to be run without logging in, and is scored 10.0 on CVSS.^[1][2]

• Is it being attacked?

  Adobe says it is not aware of exploits. The e-commerce security firm Sansec has not seen attacks on live stores either, but it reproduced four attack routes within 24 hours of the fix. The flaw is not yet in CISA's Known Exploited Vulnerabilities (KEV) catalog.^[1][3][4]

• Why hurry

  StyleSmuggler, a flaw in the same email-template machinery, was attacked in the wild from early September. Sansec says BlockStrap is of similar complexity and advises patching now rather than waiting for Adobe's 30-day window.^[5][3]

• What to do this week

  Find out whether any online shop you or your contractors run uses Magento or Adobe Commerce. If one does, have the October fix and the September fix (VULN-39341) both confirmed in the code.^[3]

What kind of flaw BlockStrap is

According to Adobe, CVE-2026-103849 is a failure to neutralise special elements in a template engine (CWE-1336). It needs no authentication and no user interaction, its impact reaches beyond the vulnerable component (Scope: Changed), and its CVSS v3.1 base score is the maximum, 10.0.^[1][2]

Sansec explains that commands smuggled in by an attacker end up inside the machinery that builds the shop's emails, such as order notices, and are finally run as PHP code on the server. It is the second critical break in the same machinery after StyleSmuggler, which was attacked in September, and it slips through a gap the September fix left open.^[3]

Affected and fixed versions

Timeline

What it means for online shops in Japan

The CCB says exploitation could lead to unauthorised access to customer and payment data, tampering with store content, and service outages.^[6] In Japan, version 6.0 of the Credit Card Security Guidelines requires online merchants, which account for 90% of card fraud losses, to put vulnerability countermeasures in place for their systems and websites. The guidelines serve as the practical standard for the security duties set by the Installment Sales Act.^[7]

In its alert updated on 23 October, JPCERT/CC also added Case E: attackers abusing AI-driven penetration testing platforms to probe mainly internet-facing web applications for vulnerabilities. Treat any public online shop as a likely target of this kind of automated probing.^[8]

How to check

Sansec gives technical staff these checks. In the Magento root, run grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php; a result of 0 means the October fix is missing (on Mage-OS, check vendor/mage-os/framework/Filter/Template.php). The September fix can be checked with vendor/bin/magento-patches -n status. The surest route is to ask your contractor to send you the output of both.^[3]

1. 01Confirm the platform: list every online shop, campaign site and test store run by you or your contractors that uses Adobe Commerce, Magento Open Source or Mage-OS.^[1][3]
2. 02Confirm the October fix in the code: get the output of the check above from your contractor. Aim to finish this week rather than waiting for Adobe's priority 2 window of 30 days.^[3][6]
3. 03Confirm the September fix too: check that VULN-39341 for StyleSmuggler is installed. That flaw is in CISA's KEV catalog as known to be exploited.^[3][4]
4. 04Decide what to do about old versions: there is no public patch for Magento Open Source 2.4.6 and earlier. Agree with your contractor when to upgrade to 2.4.7-p10 or later and how to protect the shop until then.^[3]
5. 05Step up monitoring: the CCB advises strengthening monitoring and detection to spot suspicious activity, and warns that patching does not undo an earlier compromise.^[6]

FAQ

Printable checklist

• Listed the platform behind every online shop we and our contractors run
• Included campaign sites and test stores in the list
• Confirmed in the code that the October fix (2026-oct) is on every Magento-based store
• Confirmed the September fix (VULN-39341) is also in place
• Agreed an upgrade plan with our contractor for any Magento Open Source 2.4.6 or earlier
• Set up monitoring for the store and agreed whom to call if something looks wrong

How ZeroKai can help

The first step is knowing which of your hosts can be seen from the internet. ZeroKai takes your domain, lists the host names recorded in Certificate Transparency logs and highlights names that look like admin screens or test environments. You can use it to pull out hosts named things like shop, store or staging, and as a list for asking your contractor what each one runs on.