Adobe Patches Critical BlockStrap Vulnerability; Sansec Warns Attackers May Use AI to Reverse-Engineer Fix

Adobe last week released security updates for Adobe Commerce (Magento Open Source), including a fix for CVE-2026-103849, a critical vulnerability with a maximum CVSS score of 10.0. Named "BlockStrap" by security firm Sansec, the flaw resides in the email template engine and allows for remote code execution.

Although Adobe marked the patch priority as Level 2 and Sansec has not yet observed active exploitation in the wild, the firm warned users against delaying updates. Sansec highlighted that attackers could leverage artificial intelligence to reverse-engineer the published patch, rapidly developing functional attack paths. Researchers noted they identified four exploitation methods within a single day, suggesting that AI-assisted analysis is shortening the window between patch release and weaponization.