On 13 October 2026, Adobe published critical security bulletin APSB26-153. The vulnerability CVE-2026-103849 allows an unauthenticated attacker to execute arbitrary code on a vulnerable store server. It carries the highest possible severity score: CVSS 10.0. Adobe security bulletin
Cybersecurity company Sansec calls this vulnerability BlockStrap. If you installed September’s StyleSmuggler security patch, it does not protect against this new vulnerability. These are two separate issues, and the October security patch must also be applied. Sansec research
Check your store
This tool assesses your store’s public accessibility and selected endpoint responses. It does not replace the server-side verification needed to confirm installed security patches, or determine whether your store has already been compromised.
The results show three separate findings:
- Public accessibility: whether the checked endpoint responds, the request was blocked, or the check was inconclusive.
- CVE-2026-103849: server-side verification is required to confirm the security patch.
- StyleSmuggler / CVE-2026-75650: server-side verification is required to confirm the hotfix.
Please note: a blocked request, error or timeout does not mean your store is protected. The presence of an endpoint does not, by itself, prove vulnerability.
What should store owners do now?
- Establish the current state. Ask your development or hosting partner to check the active Magento version, installed components and actual security patch coverage.
- Apply patches in the correct order. Adobe’s instructions require the relevant monthly security patches to be applied in release order. The October security patch does not include the StyleSmuggler hotfix, which must be installed separately where required. Adobe installation guidance
- Verify the server installation. Check the active installation directly on the server. Adobe’s Commerce Version Tool helps identify missing security patches and reports PROTECTED, VULNERABLE or UNKNOWN for supported CVEs. Adobe verification tool
- Make the fixes persist. Security patches must survive the next deployment. Editing files on the running server alone is insufficient: include the patches in the project’s deployment process and verify them before activating a new release.
- Test core functions. After patching, check at least the homepage, product pages, cart, checkout and login. Review server and application logs, administrator accounts and unexpected file changes too. Applying a security patch and investigating a possible compromise are separate tasks.
Want a verified answer about your store’s security?
Magentopood can check both vulnerabilities, apply the necessary security patches and test your store’s core functions. We agree the precise scope and price before starting work.
Request a store security checkTechnical sources checked on 20 October 2026.