Critical BlockStrap flaw lets hackers run code on Magento servers
BLUF
Patch or mitigate CVE-2026-103849 immediately because it can enable remote code execution on Magento and Adobe Commerce servers.
NEWS
Researchers warned that CVE-2026-103849, a maximum-severity vulnerability affecting Magento and Adobe Commerce, could allow attackers to execute arbitrary PHP code on store servers. The flaw is tied to BlockStrap functionality and may be exploited before broad defenses are in place.
Why I Care
Magento and Adobe Commerce power many high-value e-commerce environments, so remote code execution can lead to customer data theft, payment fraud, site defacement, malware injection, and full server compromise. Merchants, hosting providers, and security teams face urgent exposure because exploitation could occur with minimal user interaction.
Next Steps
Magento/Adobe Commerce administrators should identify affected instances within 24 hours and apply the vendor patch or upgrade as soon as Adobe/Magento releases it. If no patch is available, disable or remove the vulnerable BlockStrap component, restrict admin access, deploy WAF/virtual patching rules, and monitor for webshells, unauthorized admin changes, or suspicious PHP execution. Security teams should treat this as an emergency change and validate remediation before returning affected stores to normal operations.
Source: BleepingComputer ·