Critical Magento Flaw (CVE-2026-103849): Patch Your Store Now

The Short Version

BlockStrap, a component shipped with Magento and Adobe Commerce, has a maximum-severity flaw tracked as CVE-2026-103849. It allows unauthenticated remote code execution — an attacker needs no account, no session, no user interaction. They send a request to your public storefront and get a shell. If you run Magento and have not patched in the last 48 hours, do it now.

Who Is Affected?

Any internet-facing Magento Open Source or Adobe Commerce instance running a vulnerable BlockStrap version. That covers a large share of EU e-commerce: Magento powers thousands of mid-size stores precisely because it is customisable — and customised stores are the slowest to patch.

If your store is behind a VPN or IP allow-list and was never public, your exposure is lower. Verify that before relaxing.

How Bad Is Unauthenticated RCE?

As bad as it gets. The exploit chain is:

1. Attacker finds your storefront (mass scanning takes hours after disclosure).
2. Attacker sends a crafted request to the BlockStrap endpoint.
3. The server executes it — no login, no CAPTCHA, nothing.
4. Attacker installs a web shell, reads the database, skims payment forms.

Payment-card data makes e-commerce the highest-value target class for this exact bug shape. Magecart-style skimmers follow unpatched RCE the way vultures follow a wounded animal.

How Do I Check for Compromise?

• Review web server logs for unusual POST requests to BlockStrap paths from single IPs.
• Look for new, unexpected files — especially .php files with recent timestamps in media or pub directories.
• Check admin user lists for accounts you did not create.
• Review outbound connections from the web server to unknown hosts.

If you find anything, assume full compromise: database, customer PII, and payment data.

What Should E-commerce Teams Do Long Term?

• Stage patches. Keep a staging clone of the store so security patches deploy in hours, not weeks.
• Web application firewall. A WAF with virtual patching buys time between disclosure and your maintenance window.
• File integrity monitoring. Alert on any new or changed file in web roots.
• Least privilege. The web process should not be able to write to executable directories.

What Is the EU Compliance Fallback?

Under GDPR Article 33, a breach of customer personal data must be notified to your supervisory authority within 72 hours of awareness. An unpatched maximum-severity RCE on a store holding EU customer data, exploited in the wild, will be treated as negligent if you sat on the patch. NIS2 adds incident reporting for digital service providers in scope. Patch first, document everything, prepare the notification draft in parallel.

Bottom Line

E-commerce platforms are high-value targets and this is a maximum-severity, unauthenticated flaw. Patching is non-negotiable and the window is 48 hours, not next sprint. If you run Magento and want the patch validated plus a compromise check, book a Magento security review.