The gap
Adobe's October 2026 security release fixes CVE-2026-103849 in the 2026-oct releases for 2.4.9, 2.4.8 and 2.4.7. Magento Open Source installations on 2.4.4, 2.4.5 and 2.4.6 fall outside that set. Adobe's public patches cover 2.4.7-p10, 2.4.8-p5 and 2.4.9. The vendor patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 require an Adobe Commerce license.
That leaves three practical paths for an Open Source store on an older branch: upgrade to 2.4.7-p10 or later, apply a third-party backport, or accept risk with compensating controls.
What the flaw does
CVE-2026-103849 is a second-pass template directive injection in Magento's email rendering. Attacker-controlled data in a child template cannot process a {{block}} directive and returns it unchanged; the engine signs that text as part of the nested render; the root filter rescans the signed text and dispatches the directive. NVD records the vendor description, CWE-1336 and a CVSS 3.1 base score of 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Execution requires a pre-authentication input path into the email pipeline and a deployable block gadget. Sansec reproduced four routes to code execution within 24 hours of the patch and reported no attacks on live stores at the time of writing.
The upgrade path
Adobe's own guidance is the 2026-oct release in the supported branches. For 2.4.4 to 2.4.6, the supported destination is 2.4.7-p10 or later. That is a version jump that changes PHP requirements, dependency versions and often the theme and extension set, which is why it does not happen on the day a bulletin ships.
Plan it as a project rather than a patch. Stage the target release with the extension set, run the store's own regression tests against checkout, email, payment and admin workflows, and keep the rest of the security backlog in view: jumping two minor versions carries other changes that must be read, not just installed.
The backport path
Happy Horizon published backported APSB26-153 patches for Magento 2.4.4-p18 through 2.4.9, split per Composer package for use with cweagans/composer-patches. Sansec states it gives no warranty for these third-party patches and recommends upgrading to 2.4.7-p10 or later as the alternative.
Backports are a reasonable bridge for a store that cannot move quickly, with conditions. Review the patch content against the vendor fix. Verify the result in code rather than in the deploy log, using the resolveDeferredDirectives check in vendor/magento/framework/Filter/Template.php. Record who approved the exception and when it expires.
The compensating-control path
Where neither path is available within the exposure window, an HTTP-layer rule reduces the chance that a carrier reaches the template engine. Sansec Shield blocks BlockStrap at the request layer and has rules live for its stores. Any in-house rule needs to be tested against the guest GraphQL and payment-failure path the public validation lab documents, and against the store's own checkout flow, because a rule that blocks legitimate orders creates a different incident.
Compensating controls do not change the vulnerable code. They narrow the window between publication of the patch and installation, and they assume the attacker uses the shape the rule was tested against.
Sequencing all three
Whatever path a store chooses, the September hotfix comes first. BlockStrap and StyleSmuggler are separate fixes, the October patch does not include VULN-39341, and Adobe's patch registry does not list the hotfix as a prerequisite. A store that applies October only still carries the older StyleSmuggler gap.
Then verify. Check resolveDeferredDirectives in the template filter, check the hotfix with vendor/bin/magento-patches -n status, and on 2.4.8-p5 check QUOTED_LOCAL_PART_PATTERN in vendor/magento/framework/Validator/EmailAddress.php for the corrected patch file Adobe published on 14 October 2026.