# Magento and Adobe Commerce security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/magento-and-adobe-commerce-security-vulnerabilities
> Updated: 2026-10-16T23:50:06.000Z. Sources: 8. Developments: 2.

Security vulnerabilities have been identified in the Magento and Adobe Commerce web platforms. Initially, reports highlighted the active exploitation of a critical authorization vulnerability, CVE-2026-71362, which CISA noted allows attackers to gain elevated access to sensitive resources without user interaction.

Subsequent findings identified a maximum-severity flaw in Magento and Adobe Commerce known as ‘BlockStrap’ (CVE-2026-103849). This vulnerability involves second-pass template engine directive injection, allowing attackers to smuggle commands through child email templates to be processed at the root level. Security experts warned that the complexity of this attack might not prevent hackers, particularly those utilizing AI to reverse-engineer patches.

## Timeline

### 2026-10-16: Magento and Drupal face critical remote code execution vulnerabilities

Critical remote code execution vulnerabilities have been discovered in Magento and Drupal, posing significant risks to server security and requiring immediate patching by administrators.

3 sources. https://clstr.news/cluster/magento-and-drupal-face-critical-remote-code-execution-vulnerabilities

### 2026-09-24: Adobe Commerce and Magento face active exploitation of vulnerability

An active exploitation of vulnerability CVE-2026-71362 in Adobe Commerce and Magento allows attackers to gain unauthorized access to sensitive resources without user interaction.

6 sources. https://clstr.news/cluster/adobe-commerce-and-magento-face-active-exploitation-of-vulnerability

---
Cite as: Magento and Adobe Commerce security vulnerabilities. CLSTR, https://clstr.news/situations/magento-and-adobe-commerce-security-vulnerabilities