Adobe assigns two labels to a Magento security issue. CVSS describes severity. Priority describes scheduling, and in Adobe's Magento practice priority 1 is reserved for vulnerabilities the vendor knows are being exploited, which allows a shorter patch window. BlockStrap carries priority 2 and a 30-day window.
Sansec questions that split. The flaw, CVE-2026-103849, is scored 10.0 under CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and mapped to CWE-1336 by NVD. Sansec reproduced four routes to code execution within 24 hours of the patch and argues that an AI-assisted reverse-engineering effort shortens the distance between patch and exploit. Under Adobe's definition, the rating is consistent: no exploitation was known at publication, and Sansec reported no attacks on live stores when it published its analysis on 15 October 2026.
Both statements can be true. A triage decision has to pick which one governs.
Priority 2 does not mean low risk. It means the vendor's information at publication did not include exploitation. The definition creates an incentive to wait for evidence of attacks, and by then the flaw is in use.
The precedent inside the same engine is recent. StyleSmuggler, CVE-2026-75650, moved from a priority 1 hotfix in September 2026 to mass exploitation in three days, using the September hotfix VULN-39341 as its fix. Sansec describes BlockStrap as similar in complexity.
Exploitation needs a pre-authentication input path into the email template pipeline, such as guest checkout and a failed payment, and a deployable block gadget for the execution step. The public validation lab documents the carrier and the stock directive-injection primitive, and states that it did not find a compatible command execution gadget in the subset of Magento Open Source 2.4.9 it reviewed. That is a statement about one tree, not about the extension population of a real store.
A store with a large extension set has a larger gadget surface than the lab's tree. A store with no custom modules has less. That difference belongs in the triage, not in the vendor rating.
Adobe affects Adobe Commerce up to 2.4.9-2026-sep, with the earlier 2026-sep releases for 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 also listed, and Adobe Commerce B2B up to 1.5.3-2026-sep. Magento Open Source is affected in 2.4.9-2026-sep, 2.4.8-2026-sep and 2.4.7-2026-sep. Mage-OS is affected up to 3.5.0 and fixed in 3.6.0. The 2026-oct releases and 2.4.10-alpha1 are unaffected.
Open Source stores on 2.4.4, 2.4.5 and 2.4.6 have no public Adobe patch. The vendor patches for those branches need an Adobe Commerce license. Happy Horizon published backports for 2.4.4-p18 through 2.4.9, and Sansec states it gives no warranty for them while recommending an upgrade to 2.4.7-p10 or later.
Patch the supported branches inside the vendor window or shorter. For unsupported branches, decide explicitly between an upgrade project, a reviewed backport, and a compensating HTTP-layer control, and write the decision down with an expiry date.
Sequence the work: VULN-39341 first, then the October release or isolated patch, because the October patch does not carry the hotfix and Adobe's registry does not require it. Verify in code with resolveDeferredDirectives in the template filter, and with vendor/bin/magento-patches -n status for the hotfix. On 2.4.8-p5, check QUOTED_LOCAL_PART_PATTERN in vendor/magento/framework/Validator/EmailAddress.php for the corrected patch file.
Then check for execution. A flaw with a public patch and a working primitive has a window measured in days, whatever the scheduling label says.