What changed

A store template can become server-side code

Adobe rates CVE-2026-103849 at 10.0. It is a template-engine injection issue affecting Magento Open Source, Adobe Commerce and Commerce B2B. An attacker does not need an account to exploit it; the possible result is code running on the store server. Adobe included a fix in its 13 October security update, APSB26-153.

Sansec calls the flaw BlockStrap and says it reproduced four routes to code execution after examining the patch. That is a reason to move quickly, not evidence of a live attack. Adobe said it was unaware of exploitation when it published the bulletin, and Sansec reported no attacks on live stores in its 15 October analysis. Those observations may change.

Two fixes, not one

The October BlockStrap fix does not replace the September hotfix for CVE-2026-75650, also called StyleSmuggler. Adobe explicitly says to apply that hotfix in addition to APSB26-153.

Defender workflow

Verify what is running, not what the change ticket says

  1. 1

    Inventory each store. Record the product, branch and deployed October patch level for every Magento or Adobe Commerce instance. Adobe's fixed releases are branch-specific; older Magento Open Source branches may need an upgrade rather than a same-branch October patch.

  2. 2

    Apply and check both fixes. Use Adobe's APSB26-153 release or supported isolated patch, and confirm the September CVE-2026-75650 hotfix remains installed. Sansec notes that a normal Composer install alone does not prove BlockStrap is fixed.

  3. 3

    Verify deployed code and watch for misuse. Check the deployed template filter for the October fix, not just the deployment log. Review web and application logs for unusual template-related requests, and investigate unexpected server-side code or files if exposure remained after disclosure.

Defender note

A patch ticket is only as good as its evidence

For this one, the useful closure record is the affected store list, the exact October patch applied, a check against the running code, and confirmation that the September hotfix is still there. Sansec warns that some patch workflows can skip a change without failing the overall deployment. If you cannot demonstrate both fixes in the deployed store, the ticket is still open.