Security1 hOctober 25, 2026, 21:43

BlockStrap in Magento: CVSS 10.0 but priority 2 and a 30-day patch window

Sansec disputes Adobe's decision to rate Magento flaw CVE-2026-103849 as priority 2 despite its CVSS 10.0 score. Researchers reproduced four routes to code execution within 24 hours of the patch; Adobe reserves priority 1 for vulnerabilities known to be exploited.

DEV Community

Open source

BlockStrap in Magento: CVSS 10.0 but priority 2 and a 30-day patch window

CVE-2026-103849 scores CVSS 10.0 and maps to CWE-1336, yet carries priority 2 and a 30-day window
Sansec found four routes to RCE within 24 hours of the patch release
Affected: Adobe Commerce up to 2.4.9-2026-sep and Mage-OS up to 3.5.0
No public Adobe patch for Open Source branches 2.4.4 through 2.4.6

#Adobe#Magento#Sansec

Critical BlockStrap flaw lets hackers run code on Magento servers

Security

CVE-2026-75650 in Magento: 132,792 Matches and a 10.0 CVSS

Security

SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later

Security

BlockStrap in Magento: CVSS 10.0 but priority 2 and a 30-day patch window

Critical BlockStrap flaw lets hackers run code on Magento servers

CVE-2026-75650 in Magento: 132,792 Matches and a 10.0 CVSS

SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later

Microsoft patches 974 CVEs in September Patch Tuesday