A maximum-severity vulnerability affecting Magento and Adobe Commerce platforms could allow hackers to execute malicious code on store servers. Known as BlockStrap and identified as CVE-2026-103849, the flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Security researchers at Sansec have identified four potential attack paths within 24 hours, though active exploitation has not yet been documented.
Sansec researchers contend that Adobe’s priority rating of the vulnerability does not adequately reflect its severity and urgency, warning that attackers using artificial intelligence tools could develop working exploits relatively quickly. The company notes that administrators must apply both the latest patches and previous security fixes to fully address the risk, as BlockStrap and an earlier flaw called StyleSmuggler require separate corrections. Sansec expects mass attack campaigns to begin soon and plans to provide updates as attacks emerge.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
