Adobe rates CVE-2026-103849 critical with a CVSS score of 10.0 and says it knows of no exploits. Stores need the standalone October patch; a routine Composer update does not fix it.
Adobe on Tuesday issued security bulletin APSB26-153 for Adobe Commerce and Magento Open Source, including CVE-2026-103849, a template-engine flaw it rates critical with a CVSS score of 10.0 that could allow arbitrary code execution without authentication. Adobe gave the update priority 2 and says it is not aware of any exploits in the wild. E-commerce security firm Sansec, which has named the bug BlockStrap, says it reproduced four different attack routes within 24 hours of the patch and expects attackers to do the same, and questions Adobe’s priority 2 rating, which implies a 30-day patch window. Sansec says it has not seen BlockStrap attacks on live stores. Affected versions run through Adobe Commerce and Magento Open Source 2.4.9 and Commerce B2B 1.5.3 at the September 2026 patch level. According to Sansec, a plain Composer install still leaves the vulnerable base version, so merchants must apply the “2026-oct” release or Adobe’s isolated patch, and keep Adobe’s separate September hotfix for CVE-2026-75650 in place; Adobe’s bulletin also says that hotfix must be applied in addition. BleepingComputer reported Sansec’s findings on Friday.
Sources: Adobe APSB26-153 · Sansec · BleepingComputer