Sansec disputes Adobe's 30-day patch window for the BlockStrap Magento flaw
Sansec disputes Adobe's 30-day patch window for CVE-2026-103849, a maximum-severity flaw in Magento and Adobe Commerce. It has seen no attacks yet but expects mass exploitation soon, citing StyleSmuggler's three days from hotfix to mass attacks.
The Watch · Security desk
Key figures: 3 days from StyleSmuggler's priority 1 hotfix to mass exploitation, per Sansec; 30 days, Adobe's priority 2 patch window for BlockStrap, disputed; 4 potential attack paths Sansec identified in less than 24 hours.
| Figure | Value | Note | Claim |
|---|---|---|---|
| StyleSmuggler hotfix to mass exploitation, per Sansec | 3 days | 16 | |
| Adobe's priority 2 window | 30 days | disputed | 15 |
| Potential attack paths Sansec found | 4 attack paths | identified in less than 24 hours | 3 |
What happened
- Adobe published its bulletin on October 13, describing improper neutralization of special elements in a template engine that leads to arbitrary code execution.
- Affected software includes the September releases of Adobe Commerce and Magento Open Source up to and including 2.4.9, plus Adobe Commerce B2B up to and including 1.5.3.
- Sansec identified four potential attack paths involving the flaw in less than 24 hours, and that work is the basis for its warning.
Why it matters
- Who has to decide decision Operators of affected stores have to choose between scheduling the fix inside Adobe's 30-day window and treating it as urgent, as Sansec urges.
- What it limits constraint Stores that already applied the September VULN-39341 hotfix cannot swap it for the new patch. Sansec says both are needed.
- Who's exposed exposure Stores waiting for Sansec's next update are waiting for a signal that, by its own description, arrives only after mass attack waves have been detected.
BlockStrap is a second-pass template engine directive injection, in Sansec's description [6]. Content the attacker controls in a child email template is signed and then processed again at the root level, where a smuggled {{block}} directive executes [6]. Sansec places the flaw in a gap the StyleSmuggler fix left in the same email-template engine [7]. Adobe's fix replaces the generic processing with registered placeholders, and that prevents exploitation [8]. Sansec says a plain Composer install is not enough: administrators must apply the 2026-oct release or Adobe's isolated patch [9].
Adobe rated the flaw priority 2, a patch-within-30-days category, according to Sansec [15]. Sansec says that rating does not reflect the danger and urgency [13]. "The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time," Sansec said [17]. It added: "That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity." [14]
The dates are short. Counted from the October 13 bulletin, a 30-day window runs to November 12 [11]. Three days from the same date is October 16, today [12]. Sansec reported no attacks when it made its assessment [2], and it expects threat actors to find a way to exploit the flaw [19].
The strongest support for Sansec's timing is its own work: it identified four potential attack paths in less than 24 hours [3]. The StyleSmuggler comparison is one earlier case [16]. We think the evidence supports Sansec on urgency but cannot yet support a three-day timeline for BlockStrap, because no exploitation is on record and the comparison rests on one earlier flaw [2][16]. BleepingComputer's report does not say whether Sansec used an AI agent to find the four paths, or what access an attacker needs.
What to watch
- Sansec's promised update if it detects mass attack waves against CVE-2026-103849.
- Whether Adobe revises the priority 2 rating on its October 13 bulletin.
- November 12, when a 30-day window counted from the October 13 bulletin would end.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+22
- Incentives
- Not scored
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-103849, dubbed BlockStrap, is a maximum-severity vulnerability affecting Magento and Adobe Commerce that could allow attackers to execute arbitrary PHP code on store servers.
- [2]
According to Sansec, attacks leveraging BlockStrap have not yet been observed.
- [3]
Sansec based its assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours.
- [4]
The flaw affects September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
- [5]
Adobe's bulletin, published on October 13, describes the flaw as an improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
- [6]
Sansec explains that BlockStrap is a second-pass template engine directive injection that allows attacker-controlled content in a child email template to be signed and processed again at the root level, executing a smuggled {{block}} directive.
- [7]
According to Sansec's analysis, BlockStrap exposes a gap left by the StyleSmuggler fix in the same email-template engine.
- [8]
Adobe's fix replaces the generic processing with registered placeholders, preventing exploitation.
- [9]
Sansec says a plain Composer install is not enough to address the risk, and website administrators must apply the 2026-oct release or Adobe's isolated patch.
- [10]
Sansec cautions that BlockStrap and StyleSmuggler are separate fixes, that both are needed, and that the September VULN-39341 hotfix should stay in place.
- [11]
A 30-day window counted from the October 13 bulletin ends on November 12.
- [12]
Three days counted from the October 13 bulletin ends on October 16.
- [13]
Sansec warned that Adobe's priority 2 rating of this flaw does not reflect the danger and urgency in this case.
- [14]
"That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity."
- [15]
Adobe rated the flaw priority 2, which carries a patch-within-30-days window.
- [16]
Sansec says StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days.
- [17]
"The attack path is complex, but anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time,"
- [18]
Sansec says it will provide an update when it detects mass attack waves, which it expects to occur soon.
- [19]
Sansec expects threat actors to find a way to exploit BlockStrap.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comCritical BlockStrap flaw lets hackers run code on Magento servers
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- Magento securityFollow
- E-commerce securityFollow