---
title: BlockStrap (CVE-2026-103849): Sansec builds four Magento RCE routes in a day and says a plain Composer install stays vulnerable | ctxsec
url: https://ctxsec.com/items/sansec-blockstrap-magento-2026-10
description: ""
status: "confirmed (vendor fix + researcher), not exploited yet"
published: 2026-10-16
---

> 

[← Cybersecurity News](/news) · [markdown](/items/sansec-blockstrap-magento-2026-10.md)

confirmed (vendor fix + researcher), not exploited yet

2026-10-16

### BlockStrap (CVE-2026-103849): Sansec builds four Magento RCE routes in a day and says a plain Composer install stays vulnerable

Sansec's forensics team (Oct 15) named the CVSS 10.0 Adobe Commerce / Magento template-engine injection fixed in APSB26-153 "BlockStrap". It lets an unauthenticated attacker run arbitrary PHP on the store server. Affected: Adobe Commerce and Magento Open Source 2.4.9 and earlier, Commerce B2B 1.5.3 and earlier, and Mage-OS up to 3.5.0 (3.6.0, released Oct 14, has the fix). Sansec says a plain Composer install still pulls the vulnerable base version, so you must apply the 2026-oct release or Adobe's isolated patch, and keep the separate September StyleSmuggler hotfix (VULN-39341) too. Sansec has **not** seen attacks on live stores, but reproduced four exploit routes within 24 hours and disputes Adobe's priority 2 (30-day) rating, noting StyleSmuggler went from hotfix to mass exploitation in three days. Open Source stores on 2.4.6 or older get no public patch and need to move to 2.4.7-p10 or later. Not on CISA KEV.

Sources: [Sansec research](https://sansec.io/research/blockstrap-magento-rce) · [Adobe APSB26-153](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/)