Executive Summary
Adobe has shipped an emergency out-of-band hotfix for CVE-2026-75650, a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that e-commerce security firm Sansec dubbed "StyleSmuggler." The flaw allows a fully unauthenticated remote attacker to achieve arbitrary code execution on the underlying server by abusing Magento's template-processing engine — no credentials, admin session, or victim interaction required.
CVSS Score: 10.0 (Critical)
Sansec discovered the flaw only after finding it already being exploited in the wild: attackers had been using it to plant Linux backdoors on live storefronts since at least September 4, 2026, three days before Adobe's fix became available.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-75650 |
| CVSS Score | 10.0 (Critical) |
| Type | Improper Neutralization of Special Elements Used in a Template Engine |
| Component | Magento email template rendering pipeline |
| Attack Vector | Network (unauthenticated HTTP request to storefront) |
| Privileges Required | None |
| User Interaction | None |
| Discovered By | Sansec |
| Patch Released | September 7, 2026 (APSB26-146, priority 1) |
How It Works
The vulnerability lives in the template path Magento uses to generate its "Payment Transaction Failed Reminder" email. An attacker crafts a fraudulent failed-payment event that smuggles executable PHP into the value Magento later uses when rendering that email template. When the platform processes the template, the injected PHP executes in the context of the web server — no admin session, API token, or authentication of any kind is needed to trigger it.
Sansec also documented a notable bypass detail: mitigations that move PHP session storage to Redis or a database do not stop the attack. In one observed case, an attempt that failed against session-based storage was followed eight seconds later by a second attempt from the same operator that succeeded by delivering the payload through a file uploaded via Magento's custom options feature instead.
Attack Chain
1. Attacker sends a crafted request that triggers Magento's
"Payment Transaction Failed Reminder" email template
2. The request smuggles PHP through a value the template
engine treats as safe to interpolate
3. Magento renders the template, executing the injected PHP
in the web server's context
4. Attacker now has arbitrary code execution with no prior
authentication stepAffected Software
| Product | Affected Versions |
|---|---|
| Adobe Commerce | 2.4.4 through 2.4.9 (August 2026 releases and earlier) |
| Adobe Commerce B2B | 1.3.3 through 1.5.3 (August 2026 releases and earlier) |
| Magento Open Source | 2.4.4 through 2.4.9 (August 2026 releases and earlier) |
Adobe tested the hotfix against the August 2026 releases of each branch; earlier releases within those branches are also affected, but the patch has not been separately verified against them. Sansec's initial reporting characterized the underlying template code path as present across effectively all Magento and Adobe Commerce versions in support.
Exposure: StoreLeads data put active Magento deployments at roughly 111,000 stores as of Q1 2026, with broader web-technology crawlers placing total installations above 239,000. Among the top 1,000 US retailers, Magento and Adobe Commerce still power roughly one in five storefronts.
Remediation
- Apply the hotfix immediately. Download
VULN-39341-composer-patches.zipfromrepo.magento.comand apply it as a composer patch — this ships as a hotfix, not a full point release. - Verify installation:
vendor/bin/magento-patches -n status | grep "39341\|Status" - Enable maintenance mode before patching to avoid further exploitation mid-remediation.
- Assume prior compromise. Patching closes the hole but does not clean a store that was already hit — active exploitation predates the hotfix by three days, so scan rather than assume safety.
- Rotate every credential the encryption key protects, including admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH/deploy keys, and third-party extension API keys.
Detection Indicators
| Indicator | Description |
|---|---|
| A "Payment Transaction Failed Reminder" email not tied to a real failed transaction | Core exploitation artifact from the injection path |
Unexpected .php files in the media directory, including files uploaded via custom options | Secondary delivery mechanism that bypasses session-storage mitigations |
| Anomalous cron entries added outside a known deploy | Backdoor persistence mechanism observed in active campaigns |
| Outbound traffic disguised as NTP (UDP port 123) to unfamiliar hosts | C2 channel used by an observed Rust-based backdoor payload |
Why This Matters
A CVSS 10.0, pre-auth, zero-interaction RCE in one of the most widely deployed e-commerce platforms is about as severe as advisories get — the vulnerability requires nothing more than a single request to a public storefront. Combined with a three-day active-exploitation window before a patch existed, every unpatched Adobe Commerce or Magento instance should be treated as a probable incident, not a theoretical risk, until a compromise assessment says otherwise.
References
- NVD — CVE-2026-75650
- Sansec — StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
- BleepingComputer — Adobe fixes critical Magento zero-day exploited to backdoor servers