Adobe patches perfect-score vulnerability BlockStrap; Sansec warns AI may accelerate exploitation
Adobe patched CVE-2026-103849 with a CVSS score of 10. Sansec warns that AI can accelerate patch reverse-engineering, leading to rapid exploitation.
ImportanceMaterialEvidenceE2 unreplicatedWrite-upQuick
Last week, Adobe patched a series of security vulnerabilities in Adobe Commerce (Magento Open Source), including CVE-2026-103849, which has a perfect CVSS severity score of 10. Security firm Sansec named the vulnerability "BlockStrap" and warned that although no exploitation has been observed yet, users should not delay patching.
Sansec stated that they identified four attack paths for remote code execution exploiting this vulnerability within a single day, implying that attackers will likely discover similar methods quickly. The flaw exists in the email template engine, similar to another perfect-score vulnerability, StyleSmuggler, disclosed in September.
Although the attack path is complex, Sansec emphasized that anyone could use AI to reverse-engineer the patch and then exploit the vulnerability for actual attacks. This trend indicates that AI is lowering the technical barrier and time cost for advanced cyberattacks.