Critical Adobe Commerce & Magento Open Source Zero-Day Under Active Exploitation (CVE-2026-75650)

Published: Thu 10 September 2026

Prepared by: Adam Skupien, Vulnerability Security Analyst

Summary

Active exploitation of CVE-2026-75650 (CVSS 10.0), a zero-day dubbed "StyleSmuggler," has been observed against Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 8 September 2026,  and the ACSC issued its own alert, noting it is aware of a substantial number of potentially vulnerable instances in Australia .

Successful exploitation gives an attacker unauthenticated code execution on the store server and, in observed attacks, a persistent backdoor. Patching alone does not confirm a clean state, at least one fully patched store was compromised before the hotfix existed. Treat this as a dual-track response: apply the hotfix, and separately investigate for prior compromise.

Vulnerability details

• Severity: Critical. CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), Adobe's highest priority rating (1).
• Exploit status: Confirmed active exploitation since 4 September 2026, independently verified by Sansec (the discoverer) and Disrex Group via direct incident response on breached client stores. No public exploit PoC is circulating; researchers have deliberately withheld the assembled request while publishing defensive analysis.
• Patch status: Hotfix available (APSB26-146, composer patch VULN-39341). This is separate from, and must be applied in addition to, Adobe's regularly scheduled September release (APSB26-138), which does not include this fix.
• Vulnerability type: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336), unauthenticated server-side template injection.
• Impact: Arbitrary code execution as the web server user, full control of the store, its database, and any credentials it holds.
• Mechanism (independent researcher analysis, not Adobe-confirmed): Two-stage. The attacker plants PHP code in a file Magento writes during normal operation, such as a failure report or log, then triggers Magento's "Payment Transaction Failed Reminder" email; the code runs as Magento renders that template. No one needs to open the email, and delivery failure doesn't stop it.

Affected systems

All platforms are affected. Sansec reproduced the full attack chain on clean 2.4.7-2.4.9 installs, and one confirmed victim was running 2.4.6-p15 with the July and August 2026 patches already applied, current patch level does not indicate safety.

Impact

Successful exploitation gives an attacker unauthenticated code execution in the context of the web server user, equivalent to full compromise of the store application. From that position, an attacker can:

• Read the Magento encryption key and everything it protects, admin session and API tokens, payment gateway credentials, integration and OAuth secrets, and database credentials.
• Access the underlying database directly, including customer PII and any payment data the store processes or caches, depending on tokenisation and PCI-DSS scope.
• Deploy a persistent backdoor. Observed attacks have installed a Rust-based implant disguised as a Linux kernel process and re-launched via cron, giving durable access that survives a simple file cleanup.
• Pivot to connected systems (payment providers, ERP, fulfilment, marketing platforms) using harvested integration credentials, extending impact beyond the Magento instance itself.

No authentication or user interaction is required, so exposure isn't limited to admin accounts or specific roles, any internet-facing instance is at risk regardless of who can log in. Merchants processing card data should treat this as a potential PCI-DSS incident pending investigation, given the credential and payment-data exposure described above.

Mitigation actions

• Apply the APSB26-146 hotfix (VULN-39341) immediately on every Adobe Commerce, Adobe Commerce B2B, and Magento Open Source instance, regardless of current patch level.
• No workaround has been published by Adobe. Independent researchers (Disrex, ProxiBlue, Graycore) have published unofficial hardening patches, not endorsed by Adobe, for the observed attack pattern; useful as interim risk reduction, not a substitute for the hotfix.
• Apply APSB26-138 separately. Adobe's regular September release does not include the CVE-2026-75650 fix and does not replace it.
• Rotate encryption keys and everything they protect once patched: admin passwords, integration tokens, OAuth secrets, payment gateway credentials, database credentials, and SSH/deploy keys. Adobe treats this as part of remediation, not an optional follow-up.
• Investigate for prior compromise before assuming a clean state. Any internet-facing instance that was live before the hotfix existed should be checked, independent of current patch status.
• Check for known indicators:
  • Spikes in "Payment Transaction Failed Reminder" emails (legitimate declines also trigger these, investigate spikes, not single instances).
  • Unauthorised PHP files under pub/media, including the product-image cache.
  • A background process disguised as a kernel thread (observed as [kworker/u:8:0]), persisted via a cron entry re-running roughly every five minutes.
  • Unexpected crontab spool entries.
  • Anomalous loopback or local Redis connections, the implant does not always beacon externally.

Detection capabilities

MDR customers: Triskele Labs will develop and tune detections for behaviours consistent with CVE-2026-75650 exploitation across supported log sources as further technical detail becomes available.

Vulnerability Management customers: Environments will be assessed for exposed and vulnerable Adobe Commerce, Adobe Commerce B2B, and Magento Open Source instances; any findings will be communicated through priority channels.

References

• https://helpx.adobe.com/security/products/magento/apsb26-146.html
• https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
• https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2026-75650
• https://sansec.io/research/stylesmuggler-0day
• https://www.disrex.nl/blogs/stylesmuggler-magento-zero-day
• https://gist.github.com/ProxiBlue/07373c92c8c70dc746bbfdcd1f07b789
• https://github.com/graycoreio/magento2-style-smuggler-patch
•  https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/active-exploitation-of-adobe-commerce-and-magento-open-source-vulnerability