Magento BlockStrap Flaw: Which Patch to Install Now

On October 13, 2026, Adobe shipped a security update for Magento Open Source and Adobe Commerce that fixes 11 flaws. The worst one, dubbed BlockStrap, scores 10 out of 10 and lets an attacker run code on the server without logging in. It affects stores on the 2.4.4 to 2.4.9 lines that have not installed the October release.

What we know

  • The bulletin: per Adobe, APSB26-153 fixes 11 vulnerabilities rated critical, high and medium. Adobe rates it priority 2, which on its scale means patching within 30 days.
  • The main flaw: CVE-2026-103849, according to Adobe, is a template engine injection that leads to code execution. It is critical, has a CVSS score of 10.0 and needs no authentication. Adobe credits the researcher vozec.
  • A second serious flaw: CVE-2026-92909, per the same bulletin, hits Adobe Commerce B2B, also allows code execution without authentication and scores 9.8.
  • Affected versions, per Adobe: Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9, in every September 2026 build or earlier.
  • Fixed versions: Adobe labels them "2026-oct". Magento Open Source gets fixes for 2.4.7, 2.4.8 and 2.4.9. Sansec, the security firm that named the flaw, refers to them as 2.4.7-p10, 2.4.8-p5 and 2.4.9.
  • Attacks: Adobe says it is not aware of any. Sansec wrote on October 15 that it has not seen any either, but that it reproduced four attack routes within 24 hours and expects attackers to follow.
  • The September fix is still needed: Adobe asks stores to also apply the hotfix for CVE-2026-75650 from bulletin APSB26-146 (September 7). According to Sansec, the September StyleSmuggler hotfix (VULN-39341) is not part of the October update, so you need both.

What changes and what doesn't

The minimum safe version changes: any store on a September build or older stays exposed until it runs the October release.

The official priority does not change: Adobe keeps it at 2. Sansec disputes that, noting that a similar flaw in September went from patch to mass exploitation in three days, by its own count.

Two cases need care. According to Sansec, a fresh Composer install starts from the vulnerable base version, so it needs the patch too. And Magento Open Source 2.4.6 or older has no public patch: those stores need to move to 2.4.7 or later.

How to tell if you're affected

  1. Check your version. The Magento admin panel shows it in the page footer. On the server, `bin/magento --version` prints it.
  2. On 2.4.7, 2.4.8 or 2.4.9: install the "2026-oct" release for your line following Adobe's notes, and confirm the September hotfix is still in place.
  3. On Open Source 2.4.6 or older: there is no public patch. Plan the upgrade to 2.4.7 or later and, in the meantime, ask whoever runs the store for a temporary web application firewall rule.
  4. On licensed Adobe Commerce: the 2.4.4 to 2.4.6 lines do get a "2026-oct" release.
  5. On Mage-OS: per Sansec, versions up to 3.5.0 are affected; 3.6.0, released October 14, includes the fix.
  6. If you don't manage the server, ask your developer or host three things: which version you run, whether the October release is installed and whether the September hotfix is still applied.
  7. After patching, check that cart, checkout and order emails still work.

Related: Drupal Fixes a Critical Core Flaw: Update to 11.4.10 Now

Sources

Updates: if attacks using this flaw appear or Adobe changes the priority, they will be added here with a link.