Critical Vulnerability Discovered in Magento and Adobe Commerce

What changed

A critical vulnerability identified as CVE-2026-103849 has been discovered in the BlockStrap component of Magento and Adobe Commerce. This flaw could allow unauthorized users to execute arbitrary PHP code on affected servers, leading to potential data breaches and service disruptions.

Researchers have raised alarms about the likelihood of exploitation, urging immediate attention from affected parties.

Who is affected

The following products and their users are at risk due to this vulnerability:

Magento and Adobe Commerce users should be particularly vigilant, as they are directly impacted by this critical flaw.

• Magento 2.x versions
• Adobe Commerce versions
• E-commerce businesses utilizing these platforms

What to do

Organizations using Magento or Adobe Commerce should take immediate action to mitigate risks associated with this vulnerability. It is crucial to monitor for any unusual activity and apply security patches as soon as they become available.

Additionally, consider reviewing security protocols and enhancing monitoring systems to detect potential exploitation attempts.

• Stay updated on patches from Adobe and Magento.
• Implement additional security measures to safeguard against unauthorized access.
• Regularly audit server configurations and access logs.