Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 8 sources · 23 days · First seen · Last updated
Magento and Adobe Commerce security vulnerabilities
Overview
Security vulnerabilities have been identified in the Magento and Adobe Commerce web platforms. Initially, reports highlighted the active exploitation of a critical authorization vulnerability, CVE-2026-71362, which CISA noted allows attackers to gain elevated access to sensitive resources without user interaction.
Subsequent findings identified a maximum-severity flaw in Magento and Adobe Commerce known as ‘BlockStrap’ (CVE-2026-103849). This vulnerability involves second-pass template engine directive injection, allowing attackers to smuggle commands through child email templates to be processed at the root level. Security experts warned that the complexity of this attack might not prevent hackers, particularly those utilizing AI to reverse-engineer patches.
Entities
Timeline
-
[TECHNOLOGY] 3 sourcesMagento and Drupal face critical remote code execution vulnerabilities
Critical remote code execution vulnerabilities have been discovered in Magento and Drupal, posing significant risks to server security and requiring immediate patching by administrators.
-
[TECHNOLOGY] 6 sourcesAdobe Commerce and Magento face active exploitation of vulnerability
An active exploitation of vulnerability CVE-2026-71362 in Adobe Commerce and Magento allows attackers to gain unauthorized access to sensitive resources without user interaction.
Sources
ad-hoc-news.de · b2b-cyber-security.de · blogspan.net · borncity.com · cybernoz.com · cybersecurity-news.de · dev.to · it-daily.net