Critical BlockStrap flaw in Magento and Adobe Commerce could allow code execution
Event Brief generated 26 s read
Written by an AI. It was merged from the source on this page and has not been reviewed by a person.
The short version
- CVE-2026-103849 is rated maximum severity in Magento and Adobe Commerce.
- It could allow arbitrary PHP execution on store servers.
- Researchers warn exploitation could follow soon; no active exploitation is stated.
What happened
BleepingComputer reports researchers warn that hackers could soon exploit CVE-2026-103849, a maximum-severity vulnerability in the BlockStrap component affecting Magento and Adobe Commerce. It could allow attackers to execute arbitrary PHP code on store servers.
Why it might matter
Online stores running affected versions could be fully taken over once exploitation begins. Operators should check patch status now.
What we don’t know yet
The items do not give affected version numbers, a patch date, or whether any exploitation has been observed.
