Full Report
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
Analysis Summary
# Vulnerability: StyleSmuggler RCE in Adobe Commerce and Magento
## CVE Details
- **CVE ID:** CVE-2026-75650
- **CVSS Score:** 10.0 (Critical)
- **CWE:** PHP Code Injection / Remote Code Execution (RCE)
## Affected Systems
- **Products:** Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
- **Versions:**
- Adobe Commerce: 2.4.4 through 2.4.9 (versions dated 2026-aug and earlier)
- Adobe Commerce B2B: 1.3.3 through 1.5.3 (versions dated 2026-aug and earlier)
- Magento Open Source: 2.4.6 through 2.4.9 (versions dated 2026-aug and earlier)
- **Configurations:** Systems utilizing Magento’s template-processing and dependency-injection systems.
## Vulnerability Description
Codenamed **StyleSmuggler**, this flaw allows for an unauthenticated remote code execution (RCE) chain. It abuses Magento's internal template system and dependency injection code. Specifically, attackers inject PHP code to generate a "Payment Transaction Failed Reminder" email, which triggers the execution of the injected code during the email generation process.
## Exploitation
- **Status:** Exploited in the wild (Zero-day discovered Sept 4, 2026).
- **Complexity:** Low (Unauthenticated chain).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Critical (Full system access).
- **Integrity:** Critical (Ability to deploy backdoors and web shells).
- **Availability:** Critical (Potential for full system takeover or service disruption).
## Remediation
### Patches
Adobe has released a hotfix (VULN-39341). Administrators must apply the version-specific patch and **rotate encryption keys** to ensure full remediation.
- **Download Link:** repo.magento[.]com/patch/VULN-39341-composer-patches.zip
### Workarounds
No specific configuration workarounds were provided in the context; immediate patching is required due to active exploitation.
## Detection
- **Indicators of Compromise:**
- Presence of Rust-based Linux backdoors connecting to external command-and-control (C2) servers.
- Presence of PHP droppers or web shells designed to execute arbitrary PHP code.
- Unexpected generation of "Payment Transaction Failed Reminder" emails.
- **Detection methods and tools:**
- Monitor server logs for unusual template-processing activity or unauthorized dependency injection calls.
- Review filesystem for newly created or suspicious `.php` files and binary files (Rust backdoors).
## References
- **Vendor Advisories:**
- helpx.adobe[.]com/security/products/magento/apsb26-146.html
- experienceleague.adobe[.]com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
- **Relevant Links:**
- thehackernews[.]com/2026/09/adobe-patches-magento-zero-day.html