Adobe has released an emergency security update addressing a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that attackers are already exploiting in the wild. Tracked as CVE-2026-75650 and rated 10.0 on the CVSS scale, the flaw enables unauthenticated remote code execution on vulnerable e-commerce servers.
The vulnerability, dubbed StyleSmuggler by e-commerce security company Sansec, abuses Magento’s template-processing functionality to inject and execute malicious PHP code. Attacks were first confirmed on September 4, 2026, several days before Adobe released its emergency hotfix on September 7.
Threat actors have already used the zero-day to deploy a Rust-based Linux backdoor and, in separate attacks, a PHP web shell capable of executing arbitrary PHP commands. Because exploitation requires no valid Magento account or user interaction, internet-facing stores running vulnerable builds should be treated as high-priority targets for patching and retrospective investigation.
CVE-2026-75650 analysis
Adobe classifies the vulnerability as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. Its CVSS vector indicates network-based exploitation, low attack complexity, no privileges, and no user interaction, with potentially high impact to confidentiality, integrity, and availability.
The most important details for CVE-2026-75650 concern the way Magento turns attacker-controlled data into executable PHP during normal application processing. StyleSmuggler abuses template directives and internal dependency-injection functionality rather than relying on a malicious extension or administrator account.
At a high level, the known attack follows two stages. First, attacker-controlled PHP content is written into a file Magento can later access, such as an application log or report. A second request then causes Magento’s template-processing chain to reach dependency-injection scanner functionality that loads the poisoned file using PHP include or require_once. Because these functions interpret PHP rather than merely reading the file, the attacker-controlled code executes on the server.
Sansec describes another observable aspect of the chain: attackers deliberately trigger Magento’s normal Payment Transaction Failed Reminder email. The malicious code runs while Magento renders the template, so a customer or administrator does not need to open the email. The exploit can even succeed when actual email delivery fails.
CVE-2026-75650 affects the following Adobe Commerce branches according to Adobe’s emergency bulletin:
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
- 2.4.5-2026-aug and earlier
- 2.4.4-2026-aug and earlier
Affected Adobe Commerce B2B versions include:
- 1.5.3-2026-aug and earlier
- 1.5.2-2026-aug and earlier
- 1.4.2-2026-aug and earlier
- 1.3.4-2026-aug and earlier
- 1.3.3-2026-aug and earlier
Magento Open Source branches through 2.4.9-2026-aug are also covered by Adobe’s bulletin.
Sansec independently reproduced the full unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations. Its first confirmed compromised customer was running Magento 2.4.6-p15 with both the July and August security updates applied, demonstrating that systems considered fully patched before September 7 were still vulnerable to the zero-day.
Once remote code execution is obtained, compromise extends beyond Magento itself. The first observed campaign deployed a small Rust-based Linux implant that established persistence and communicated with attacker infrastructure while disguising itself as legitimate system activity.
Early versions masqueraded as a kernel worker process named:
[kworker/u:8:0]Later builds adopted names including:
fc-cache
and:
chronyd
The fc-cache variant stored itself under ~/.cache/fontconfig/fc-cache, added a cron entry to restart twice per hour, and used UDP port 123 traffic designed to resemble NTP communications. Sansec reported that related domains resolved to 185.157.160.251 as of September 7.
A separate attacker was observed abusing the same vulnerability to deliver a small PHP dropper. That payload created a hidden PHP web shell under a path resembling:
pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php
The shell normally returned an HTTP 404 response, but requests containing the required X-Cache-Token header could provide PHP code through a POST parameter for execution.
These observations show that StyleSmuggler is not tied to a single malware family or threat actor. Multiple adversaries can independently use the underlying RCE to deploy their preferred persistence and post-compromise tooling.
Sansec recorded the first confirmed exploitation on September 4 at 22:20 UTC. Another Magento server investigated by Disrex was compromised approximately 50 minutes later. Adobe released bulletin APSB26-146 and the official emergency hotfix on September 7, confirming that exploitation was already occurring in the wild.
A complete public CVE-2026-75650 PoC containing the assembled exploit request was not included in the sources reviewed. Sansec and Disrex have published extensive technical information about the underlying chain but intentionally withheld a fully weaponized request that would make exploitation trivial to reproduce.
Useful CVE-2026-75650 IOCs include suspicious processes and files associated with the Rust implant, unusual PHP files beneath Magento media directories, unexpected Payment Transaction Failed Reminder activity, and the infrastructure identified by Sansec. Defenders should also search for malicious report or log content rather than limiting investigations to the Magento webroot.
CVE-2026-75650 Mitigation
Adobe has classified APSB26-146 as Priority 1 and instructs affected customers to apply the dedicated VULN-39341 hotfix immediately. The official patch package is distributed through Adobe’s Magento repository for affected Commerce and Magento Open Source releases.
Adobe additionally instructs customers to rotate their encryption keys after applying the hotfix. This is particularly important for stores that were exposed before September 7 because successful arbitrary code execution may have allowed attackers to access application secrets and sensitive server-side configuration.
CVE-2026-75650 detection should therefore begin with three questions:
- Was the store accessible from the internet between September 4 and installation of Adobe’s hotfix?
- Was VULN-39341 successfully applied?
- Are there signs that PHP or native processes were launched before remediation?
To Detect CVE-2026-75650 exploitation or post-compromise activity, security teams should look for:
- Unexpected bursts of Payment Transaction Failed Reminder emails
- Suspicious PHP content in Magento logs or files under var/report/
- Report files containing unusual x_trace_ strings
- Processes masquerading as [kworker/u:8:0], fc-cache, or chronyd
- ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/fc-cache
- Suspicious cron jobs restarting unknown binaries
- Unexpected PHP files underneath pub/media/
- Web shells under pub/media/catalog/product/cache/
- Outbound traffic to known StyleSmuggler infrastructure
- Abnormal UDP/123 communications from the Magento application host
- Unexpected HTTP requests involving unusual template-processing behavior
- New application users, changed credentials, or modified server configuration following suspicious web activity
Administrators should not assume that deleting a suspicious file from the Magento directory removes the compromise. In investigated incidents, malware relocated outside the webroot, created cron-based persistence, continued executing from deleted files, and could recreate parts of its persistence after removal.
The CVE-2026-75650 mitigation process should therefore include incident response for stores that were publicly reachable before patching. If compromise indicators are discovered, isolate the host, preserve forensic evidence, terminate malicious processes, identify persistence mechanisms, review filesystem changes, and rotate credentials and secrets accessible from the affected server.
Particular attention should be paid to:
- Magento administrator credentials
- Adobe Commerce encryption keys
- Database credentials
- API and integration secrets
- Payment and third-party service credentials
- SSH credentials
- Cloud or hosting tokens accessible from the application host
Security teams should also validate the integrity of Magento application files and extensions and investigate outbound network activity for signs that an implant communicated with external command-and-control infrastructure.
Because the initial StyleSmuggler attacks occurred before an official patch or public detection signatures were available, simply confirming that a store is now updated does not establish that it was never compromised. Any internet-facing vulnerable system operating during the September 4–7 zero-day window warrants historical review.
FAQ
What is CVE-2026-75650 and how does it work?
CVE-2026-75650 is a CVSS 10.0 unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source. Attackers can abuse Magento’s template-processing functionality to poison a server-accessible file with PHP and then trigger an internal code path that loads and executes the malicious content. The attack does not require a valid Magento account or user interaction.
When was CVE-2026-75650 first discovered?
Sansec detected the first confirmed StyleSmuggler exploitation on September 4, 2026 at 22:20 UTC and publicly disclosed the zero-day on September 5. Adobe released the official CVE, security bulletin, and VULN-39341 hotfix on September 7.
What is the impact of CVE-2026-75650 on systems?
Successful exploitation provides arbitrary code execution on the e-commerce server. Real-world attackers have already used the flaw to deploy a persistent Rust-based Linux backdoor and a separate PHP web shell. Depending on the privileges of the application process, attackers may also access credentials, customer or store data, application secrets, payment integrations, and connected infrastructure.
Can CVE-2026-75650 still affect me in 2026?
Yes. Any affected Adobe Commerce or Magento Open Source system that has not received Adobe’s VULN-39341 hotfix remains vulnerable. Organizations that patched only through the August 2026 security release can still be exposed because the zero-day was not addressed until Adobe’s September 7 emergency update.
How can I protect myself from CVE-2026-75650?
Apply Adobe’s VULN-39341 hotfix immediately and rotate Commerce encryption keys as instructed by Adobe. Organizations should also investigate systems that were exposed before patching, search for the published StyleSmuggler indicators, inspect Magento logs and media directories for malicious PHP, review suspicious processes and cron jobs, and rotate credentials if compromise is suspected.