Critical BlockStrap flaw lets hackers run code on Magento servers

Sansec warned of a maximum-severity vulnerability (CVE-2026-103849) in Magento and Adobe Commerce that could let attackers execute arbitrary PHP code on store servers. No attacks have been observed yet, but researchers found four potential exploit paths in under 24 hours, and Adobe rated the patch priority 2.

• CVE-2026-103849 allows arbitrary PHP code execution on store servers
• Sansec identified four potential exploit paths in under 24 hours
• Affects Adobe Commerce and Magento Open Source through 2.4.9, B2B through 1.5.3
• Adobe rated the patch priority 2; Sansec calls that rating too low