CVE-2026-103849

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9 (prior to October 2026 security releases) Adobe Commerce B2B versions 1.3.x through 1.5.x Magento Open Source versions 2.4.6 through 2.4.9 (prior to October 2026 security releases)

Description An improper neutralization of special elements used in a template engine, specifically within the BlockStrap page builder plugin, allows unauthenticated remote attackers to perform template injection. This flaw enables the execution of arbitrary PHP code on the underlying server without requiring user interaction or administrative privileges. Successful exploitation can lead to full server compromise, including data exfiltration, webshell deployment, and lateral movement within the e-commerce environment. The attack is carried out via the plugin's API endpoints.

Recommendations Update Adobe Commerce to the corresponding October 2026 security releases (branches 2.4.4-2026-oct through 2.4.9-2026-oct). Update Adobe Commerce B2B to the appropriate fixed release. Update Magento Open Source to the corresponding October 2026 security release. As a temporary mitigation, disable or remove the BlockStrap plugin. Restrict external access to the BlockStrap plugin API endpoints using a Web Application Firewall (WAF) or server-level configuration.