Security firm Sansec said on October 15 that BlockStrap (CVE-2026-103849) lets attackers with no login run their own PHP code on Magento and Adobe Commerce servers. It scores 10.0, the top mark. Adobe released a fix on October 13, and Sansec says it must be installed by hand. This is the second critical flaw in Magento's email template engine in six weeks, after StyleSmuggler. In both, text from an attacker is treated as trusted and then runs as code.
No BlockStrap attacks are known so far, according to Sansec and BleepingComputer. Sansec says Adobe told the Magento community Slack that priority 1 is kept for flaws already under attack, so this one got priority 2, a 30-day window. Sansec disagrees. It says it built four working attack routes within a day of the patch, and StyleSmuggler went from a priority 1 hotfix to mass attacks in three days. Sansec sells tools aimed at this risk, Shield and eComscan. Adobe's public patches skip Open Source 2.4.6 and older, so Sansec says those stores must upgrade to 2.4.7-p10 or later. No attack date is known.
For anyone running a Magento store, the vendor's label may not be the real deadline. Sansec warns that patch tools can skip a piece of the fix without failing the build. Check the code: if the command grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php prints 0, the fix is missing. Also keep the September StyleSmuggler hotfix, VULN-39341, because Sansec says the two fixes are separate and both are needed.