Will CVE-2026-103849 (Magento BlockStrap RCE) be actively exploited in the wild by Dec 2026?

Researchers warn of a maximum-severity vulnerability (CVE-2026-103849) in Magento and Adobe Commerce allowing arbitrary PHP code execution on store servers. BlockStrap is a widely-used Magento extension, making this a high-value target for attackers. Source: Bleeping Computer.

Resolution Criteria

Confirmed by CISA KEV addition, vendor advisory documenting active exploitation, or credible security research reports documenting PoC or in-the-wild exploitation.