Threat reportVulnerabilityTL-2026-3773
Critical BlockStrap flaw (CVE-2026-103849) lets attackers run code on Magento / Adobe Commerce servers
Critical BlockStrap flaw (CVE-2026-103849) lets attackers (TL-2026-3773), also tracked as BlockStrap, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-16. It has no confirmed attribution, affects Adobe Adobe Commerce, references 2 CVEs (CVE-2026-103849, CVE-2026-75650), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1505.003), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3773
- Threat ID
- TL-2026-3773
- Also known as
- BlockStrap
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, ecommerce, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Critical BlockStrap flaw (CVE-2026-103849) lets attackers
Malware and tooling: 485-byte PHP web shell (StyleSmuggler second wave), PHP, Acunetix, Sansec eComscan
How Critical BlockStrap flaw (CVE-2026-103849) lets attackers works
BlockStrap (CVE-2026-103849, CVSS 10.0) is an unauthenticated second-pass template engine directive injection in Adobe Commerce and Magento Open Source email templating that yields remote PHP code execution. Adobe fixed it in APSB26-153 (2026-10-13); no exploitation is observed yet, but Sansec expects rapid weaponization through patch diffing.
BlockStrap, named by Sansec, is a second-pass template engine directive injection in Magento's template filter (vendor/magento/framework/Filter/Template.php). Attacker-controlled content placed in a child email template is signed and then rescanned at the root level, where a smuggled {{block}} directive is executed inside Magento's rendering engine. The result is arbitrary PHP code execution on the server without authentication. Adobe classifies it as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
The flaw exploits a gap left by the fix for StyleSmuggler (CVE-2026-75650, APSB26-146, Adobe hotfix VULN-39341), the actively exploited email-template zero-day from September 2026. Together they are two successive breaks in Magento's email template engine within about six weeks. Adobe's fix in APSB26-153 replaces generic rescanning with registered placeholders. BlockStrap and StyleSmuggler are separate fixes and both must be present.
Affected: Adobe Commerce 2.4.4 through 2.4.9 (2026-sep and earlier), Magento Open Source 2.4.6 through 2.4.9 (2026-sep and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3, and Mage-OS up to 3.5.0 per Sansec. Plain Composer installs retain the vulnerable base version, so the 2026-oct release or Adobe's isolated patch is required.
Exploitation status: Adobe states it is not aware of exploits in the wild and assigned Priority 2. Sansec reports no active attacks as of 2026-10-15, but its researchers identified four distinct attack routes within 24 hours of analysis, and it warns that anyone with an AI agent can reverse-engineer the patch into a working exploit quickly. Sansec deployed Shield protection on 2026-10-14. The sources report no threat actor, PoC release, or network IOCs for BlockStrap. For context, StyleSmuggler was exploited by multiple unrelated attackers beginning 2026-09-04, before disclosure, and the same operators and tooling may be expected to pivot to BlockStrap.
MITRE ATT&CK techniques used in TL-2026-3773
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1588.006 Obtain Capabilities: Vulnerabilities
Reconnaissance
Affected products and versions in Critical BlockStrap flaw (CVE-2026-103849) lets attackers
- Adobe — Adobe Commerce
Vulnerable versions: 2.4.4-2026-sep and earlier; 2.4.5-2026-sep and earlier; 2.4.6-2026-sep and earlier; 2.4.7-2026-sep and earlier; 2.4.8-2026-sep and earlier; 2.4.9-2026-sep and earlier
Fixed in: 2.4.4-2026-oct through 2.4.9-2026-oct - Adobe — Magento Open Source
Vulnerable versions: 2.4.6-2026-sep through 2.4.9-2026-sep and earlier
Fixed in: 2.4.6-2026-oct through 2.4.9-2026-oct - Adobe — Adobe Commerce B2B
Vulnerable versions: 1.3.3-2026-sep through 1.5.3-2026-sep and earlier
Fixed in: 1.3.3-2026-oct through 1.5.3-2026-oct - Mage-OS — Mage-OS (mageos-magento2)
Vulnerable versions: 3.5.0 and earlier (per Sansec)
Remediation for Critical BlockStrap flaw (CVE-2026-103849) lets attackers
Patches
- APSB26-153 (published 2026-10-13): Adobe Commerce 2.4.4-2026-oct to 2.4.9-2026-oct, Magento Open Source 2.4.6-2026-oct to 2.4.9-2026-oct, B2B 1.3.3-2026-oct to 1.5.3-2026-oct
- VULN-39341 composer patch (StyleSmuggler, APSB26-146) must remain applied
Immediate actions
- Apply the Adobe Commerce / Magento Open Source 2026-oct release or Adobe's isolated APSB26-153 patch
- Keep the September VULN-39341 (StyleSmuggler) hotfix in place; BlockStrap and StyleSmuggler are separate fixes and both are required
- Verify the fix: grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php (0 means the fix is missing)
- Review web access logs for template injection payloads such as {{block}} directives in email template and CMS content inputs
Workarounds
- Plain Composer installs do not receive the fix; update to the 2026-oct release or apply the isolated patch
- Mage-OS users (affected up to 3.5.0 per Sansec) should apply a patched Mage-OS release when available
Longer-term hardening
- Track Adobe security bulletins and apply Adobe Commerce patches within days, not the 30-day Priority 2 window, given the patch-diffing risk
- Scan stores for backdoors and missing patches (for example with Sansec eComscan)
- Place a WAF or runtime shield with template-injection rules in front of storefront and admin endpoints
CVEs associated with Critical BlockStrap flaw (CVE-2026-103849) lets attackers
Weaknesses (CWE) in Critical BlockStrap flaw (CVE-2026-103849) lets attackers
Timeline of Critical BlockStrap flaw (CVE-2026-103849) lets attackers
- Exploitation of the related StyleSmuggler (CVE-2026-75650) email-template flaw begins, before public disclosure
- Adobe ships the StyleSmuggler hotfix VULN-39341 as a composer patch; BlockStrap later exploits a gap left by this fix
- Adobe publishes APSB26-153 (Priority 2) fixing CVE-2026-103849 and ten other CVEs; no exploits in the wild reported
- Sansec deploys Shield protection against BlockStrap for its customers
- Sansec publishes public analysis of BlockStrap, reports four attack routes found within 24 hours and no active exploitation
- BleepingComputer reports BlockStrap and warns exploitation is expected soon via patch reverse-engineering, including with AI agents
Sources cited for Critical BlockStrap flaw (CVE-2026-103849) lets attackers
- Critical BlockStrap flaw lets hackers run code on Magento servers
- Sansec: BlockStrap Magento RCE
- Adobe Security Bulletin APSB26-153
- Adobe fixes critical Magento zero-day exploited to backdoor servers (StyleSmuggler)
- Style Smuggler: Actively Exploited Magento/Adobe Commerce RCE 0-Day (CVE-2026-75650)
- Rapid response to StyleSmuggler (scandiweb)
- APSB26-153 security patches for Magento (Meetanshi)
Detection coverage for TL-2026-3773
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3773 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.