CVE-2026-75650

What is Adobe Commerce / Magento?

Adobe Commerce (formerly Magento Commerce) and its open-source sibling Magento Open Source power a large share of mid-market and enterprise online stores. The platform handles catalog, checkout, payment integration, and customer accounts, so a compromised instance exposes card data, personal information, and the storefront itself. Magento has been a favorite target of Magecart-style skimming groups for a decade, and each new pre-auth remote code execution bug is weaponized within days.

Overview

CVE-2026-75650, dubbed StyleSmuggler by Sansec, is an unauthenticated template injection (CWE-1336) in Adobe Commerce and Magento Open Source rated CVSS 10.0. It was exploited as a zero-day beginning 2026-09-04. Adobe shipped an out-of-band Priority 1 hotfix on 2026-09-07, and CISA added the CVE to KEV the following day with a three-day deadline. Multiple threat actors were already deploying Rust backdoors and PHP web shells before the fix was available.

Affected Versions

The fix is a composer patch (VULN-39341-composer-patches.zip) distributed via repo.magento.com and the Quality Patches Tool, not a full version bump. It is separate from the regular September security release APSB26-138. Confirm it is applied with:

vendor/bin/magento-patches -n status | grep -E "39341|Status"

Technical Details

Magento's email and layout rendering pipeline runs a template engine that supports directives inside content strings. StyleSmuggler abuses the styles property handling in that template processing: an attacker smuggles PHP code into a field that ends up embedded in a stored template context, and the sanitization filters do not treat the styles path as a directive sink. The primary injection vectors identified by Sansec are the public GraphQL endpoint and the PayPal transparent-redirect response handler, both reachable without a session.

The attack is two-stage. Stage one plants the payload (frequently by triggering an error report that persists the attacker-controlled value). Stage two waits for the platform to render the "Payment Transaction Failed Reminder" transactional email, at which point the template engine evaluates the injected directive and executes the attacker's PHP with the web server's privileges.

Attack characteristics:

• Authentication: none
• Complexity: low once the payload format is known
• Vector: network, via normal storefront endpoints
• Impact: full RCE with scope change (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Discovery

Sansec, an e-commerce security firm, detected the exploitation in the wild on 2026-09-04 and coined the name StyleSmuggler. This was not a coordinated researcher disclosure; the vendor learned of the bug from live attacks.

Exploitation Context

Sansec observed the first exploitation at 22:20 UTC on 2026-09-04. At least two independent actors were active before Adobe's hotfix:

• Rust backdoor operator. Dropped Rust binaries disguised as [kworker/u:8:0], fc-cache (v2.1.4), and chronyd (v2.1.5), with command-and-control traffic disguised as NTP to 99.84.67.186:443 and ntp.timesync.to (185.157.160.251).
• PHP web shell operator. Wrote a shell to pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php gated by a custom X-Cache-Token request header.

Later toolkits included gs-netcat (Global Socket) and a remote access trojan tracked as WraithC2, with additional C2 at 213.111.146.27. The attack requires no user interaction and works against default installs, so every unpatched internet-facing store should be assumed probed.

Remediation

1. Apply hotfix VULN-39341 immediately on every Adobe Commerce, Magento Open Source, and B2B instance in the affected ranges, including staging and development copies that share credentials with production.
2. Verify the patch status with the magento-patches command above; a failed composer patch application can leave the store vulnerable without an obvious error.
3. Hunt for backdoors. Search pub/media/catalog/product/cache/ for ss_* directories containing PHP files. List running processes and compare against expected binaries; fc-cache and chronyd binaries that are not package-managed, or a [kworker/u:8:0] process not owned by the kernel, are indicators.
4. Block and search for the C2 infrastructure 99.84.67.186, 185.157.160.251 (ntp.timesync.to), and 213.111.146.27 in egress and proxy logs.
5. Rotate secrets after patching. Adobe recommends rotating the Magento encryption key; also rotate database credentials, payment gateway API keys, and admin passwords because a compromised store exposed all of them.
6. Review transactional email templates and error reports for unexpected content in styles fields, and review recent GraphQL and PayPal callback traffic for anomalous payloads.
7. Enable a web application firewall rule set that covers StyleSmuggler (Sansec Shield and major WAF vendors published rules on 2026-09-05) as defense in depth while the fleet is patched.