Magento BlockStrap Patch: Fix It Before Black Friday

· magento 2

Table of contents

Six weeks after the APSB26-146 zero-day, Magento's email template engine is in the news again. On October 13, 2026, Adobe published APSB26-153, and Sansec named its most serious flaw BlockStrap: CVE-2026-103849, rated CVSS 10.0, which lets an unauthenticated attacker run PHP on the server. Black Friday is on November 27 this year. If your store is not patched by then, you are going into your busiest week with an open door. Here is how I approach this Magento BlockStrap patch.

What BlockStrap is

The facts I could check against Adobe's bulletin and Sansec's analysis:

  • What: a template injection flaw in the email template engine, the same area as September's StyleSmuggler flaw. No login is needed to exploit it.
  • Affected: Adobe Commerce and Magento Open Source 2.4.4 to 2.4.9 ("2026-sep and earlier"), Adobe Commerce B2B up to 1.5.3, and Mage-OS up to 3.5.0.
  • Exploitation: as of October 15, Sansec had seen no attacks on live stores, but its researchers reproduced four different attack routes within 24 hours of the patch. That gap rarely lasts long.
  • Priority: according to Sansec, Adobe rates the bulletin Priority 2, which suggests a 30-day window. Sansec considers that too slow for an unauthenticated RCE, and so do I.

Find the right patch for your version

This is where most of the confusion is. Adobe ships the October fix as isolated patches, one ZIP per release line, and publishes no Composer packages for it:

  • 2.4.9, 2.4.8-p5 and 2.4.7-p10: patches available, including for Magento Open Source.
  • 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18: patches exist, but Adobe's page says Open Source merchants can only download patches for 2.4.7 and later. If you run Magento Open Source 2.4.6 or older, the realistic answer is an upgrade to 2.4.7 or newer.
  • Adobe Commerce Cloud: use the latest cloud-patches update instead of the isolated ZIP. Applying both can break the installation.
  • Mage-OS: upgrade to 3.6.0, released on October 14 with the fix.

Two more details from the bulletin and Sansec that are easy to miss:

  • Adobe asks you to apply isolated patches only on the latest -p release of your line, and to apply the earlier monthly patches first, in order.
  • For 2.4.8-p5, Adobe corrected the patch file on October 14. Sansec says to use the corrected 248p5-2026-10-001-CE.patch plus the separate 248p5-2026-10-002-CE patch. If you downloaded the ZIP on the first day, download it again.

Keep the September hotfix

BlockStrap and StyleSmuggler are separate fixes. Adobe states that the hotfix for CVE-2026-75650 (the September zero-day) is not included in the October isolated patch and must be applied separately. Sansec gives the same advice: keep VULN-39341 in place and apply it before the October patch.

If you skipped September because "we'll catch up with the next release", this is the moment to apply both. One unauthenticated RCE in the same component is a warning. Two in six weeks is a pattern attackers will keep probing.

Apply and verify it properly

My order of operations on a typical Composer-based install:

# 1. Know exactly what you run
bin/magento --version
composer show magento/product-community-edition | grep versions

# 2. Check which patches are already applied
php vendor/bin/patch-status

# 3. Apply the matching isolated patch (staging first), then rebuild
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

Then verify the code, not the deploy log. Sansec warns that patch tools can skip hunks silently, and that a plain composer install still pulls the vulnerable base version. Their check: the method resolveDeferredDirectives must exist in vendor/magento/framework/Filter/Template.php.

grep -n "resolveDeferredDirectives" vendor/magento/framework/Filter/Template.php

No result means no fix, whatever the pipeline says. Finally, run the usual smoke test: home, category, product, add to cart, checkout, customer login and the admin. Transactional emails deserve a test order of their own, since the patch touches the email template engine.

Why Black Friday changes the timing

Many teams freeze deployments in November. That is sensible for features and dangerous for security patches. If your code freeze starts mid-November, BlockStrap has to land before it, ideally this week. I also check three things before the freeze:

  • Your agency or host confirms in writing which patches are applied on production, not just on staging.
  • A WAF rule or virtual patch (Sansec offers one for BlockStrap) covers you while the real patch goes through QA, not instead of it.
  • A quick compromise check: recently changed files outside deployments, new admin users or integration tokens, and scripts injected into CMS blocks or the core_config_data design settings. I described these checks in my post on the September zero-day, and they apply here too.

Conclusion

BlockStrap is a CVSS 10.0, unauthenticated code execution flaw in Magento's email template engine, and public exploit routes are already known to researchers. Find the isolated patch for your exact version (or upgrade from Open Source 2.4.6), keep September's hotfix, check for resolveDeferredDirectives instead of trusting the deploy, and get it all live before your Black Friday code freeze. Read Adobe's bulletin and Sansec's analysis before you act: they are the sources of truth, this post is my checklist.

© 2026 Addeos