Adobe patches critical Magento flaw that could let attackers run code

Adobe has released an October security update for Adobe Commerce and Magento Open Source that fixes 11 vulnerabilities, including a maximum-score flaw that can be exploited without authentication to achieve arbitrary code execution on affected installations.

Adobe’s APSB26-153 bulletin, published October 13, 2026, is a priority 2 update. It covers Adobe Commerce, Adobe Commerce B2B, and Magento Open Source and includes vulnerabilities rated critical, high, and medium. The potential impacts listed by Adobe include arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass.

The affected ranges are broad:

• Adobe Commerce: 2.4.4 through 2.4.9 September 2026 builds and earlier.
• Adobe Commerce B2B: 1.3.3 through 1.5.3 September 2026 builds and earlier.
• Magento Open Source: 2.4.6 through 2.4.9 September 2026 builds and earlier.

Adobe lists October 2026 update lines for Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, and Magento Open Source 2.4.7 to 2.4.9, along with 2.4.10-alpha1. Adobe’s Experience League guidance also provides isolated patch files for specific versions and components.

Blockstrap is the flaw driving the urgency

CVE-2026-103849 is listed by Adobe as an improper neutralization of special elements used in a template engine, or CWE-1336. Adobe says the issue can result in arbitrary code execution, requires no authentication, and carries a CVSS base score of 10.0.

Ecommerce security firm Sansec calls the issue Blockstrap and describes it as a second-pass directive injection in Magento’s email template engine. According to Sansec, the flaw is separate from the September StyleSmuggler issue, CVE-2026-75650, but both affect the same area of Magento’s template handling.

Adobe’s October bulletin asks merchants to apply the September hotfix for CVE-2026-75650 in addition to the APSB26-153 update. Adobe’s September bulletin said CVE-2026-75650 had been exploited in the wild, and Experience League guidance says the October isolated patch does not include that hotfix.

Patch status may be easy to misread

The operational problem is not simply whether a store received an October patch. Adobe’s Experience League guidance says the monthly isolated patches build on earlier monthly patches and must be applied cumulatively, in release order. It also notes that patch ZIP files can include separate files for installed components such as CE, EE, B2B, and PageBuilder, so the right files depend on the store’s component mix.

Adobe recommends using the Commerce Version Tool to check which monthly security patches are installed, which are missing, and whether each CVE is marked protected, vulnerable, or unknown. The tool is available through the July 2026 isolated patch, according to Adobe’s guidance. Adobe Commerce on Cloud users also have Quality Patches Tool verification as an alternative when Commerce Version Tool is not available.

Adobe revised the October isolated security patch for Adobe Commerce and Magento Open Source 2.4.8-p5 on October 16. The original patch included the required vulnerability fix but omitted an additional defense-in-depth change. Because the revised patch uses the same filename, Commerce Version Tool may report some patches as UNKNOWN even when the original protection is installed. Adobe advises affected merchants to download the revised patch, replace the original through their normal patch-management process, and verify the installation again.

A store can have an October package applied and still need a September hotfix, an earlier monthly isolated patch, or a component-specific patch file.

What ecommerce teams should check now

Confirm the full patch chain and document the result.

• Version and edition: Identify the Adobe Commerce, Adobe Commerce B2B, or Magento Open Source version, including whether B2B, PageBuilder, or other component-specific patches apply.
• October patch path: Apply the matching October 2026 update or isolated patch for the active release line, following Adobe’s required patch order. Magento Open Source merchants on version 2.4.6 or earlier cannot download the October isolated patch through Adobe’s public Open Source route and need an appropriate upgrade or another verified remediation path. Adobe Commerce Cloud users should first check whether the latest cloud-patches update already includes the fix, since applying the isolated patch again can cause installation failures.
• September hotfix: Confirm CVE-2026-75650, also referenced as VULN-39341, is applied separately where required.
• Patch verification: Run Commerce Version Tool or the relevant Adobe verification process and review the per-CVE status.
• Post-patch checks: Test checkout, admin access, payment integrations, search, and custom modules before returning the patched environment to normal traffic.
• Exposure review: If patch history is unclear or the September flaw may have affected the store, scan for malware and investigate possible compromise. Adobe also strongly recommends rotating encryption keys and associated credentials as part of the September vulnerability’s remediation.

The risk is serious, but the evidence has limits

Current public evidence does not support saying Blockstrap is already being widely exploited. Adobe said it was not aware of active exploitation for APSB26-153 at publication time, and Sansec said it had not seen Blockstrap attacks on live stores as of its October 15 write-up.

Sansec reported reproducing four code-execution routes within 24 hours of Adobe’s update. The firm also warned that patch details could be reverse-engineered into working exploits in a short period.

Get new small business insights by email

Practical ideas and useful articles to help you make better business decisions.

Email address

Subscribe Submitting

No spam. Unsubscribe anytime. Privacy policy .

Check your inbox

Confirm your email to complete your subscription. If the message doesn’t arrive shortly, check your spam folder.