As reported by The Hacker News, Adobe has released emergency patches for CVE-2026-75650 — a CVSS 10.0 arbitrary code execution vulnerability in Adobe Commerce and Magento Open Source that is being actively exploited in the wild. Sansec, the e-commerce threat research firm that discovered the zero-day, has dubbed it StyleSmuggler. What makes this particularly dangerous is the speed of weaponization: Disrex reports a compromised Magento server was hit roughly 50 minutes after the first confirmed exploitation on September 4, 2026.
This is not a theoretical risk. If you operate a Magento-based storefront and have not yet applied the VULN-39341 patch, you should consider your environment potentially compromised and begin incident response triage immediately.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-75650 |
| CVSS | 10.0 (Critical) |
| Type | PHP code injection via template system / unauthenticated RCE |
| Vendor | Adobe |
| Products | Adobe Commerce, Magento Open Source, Adobe Commerce B2B |
| Affected Versions | 2.4.4 through 2.4.9 (2026-aug and earlier); B2B 1.3.3 through 1.5.3 |
| Patch | VULN-39341 (available via repo.magento.com) |
| Exploitation | Active in the wild since September 4, 2026 |
| Post-Exploitation | Rust-based Linux backdoor, PHP web shell dropper |
Why This Matters
StyleSmuggler is significant for several reasons beyond the headline CVSS score:
Vulnerability Details
Unauthenticated RCE on a payment-handling platform. Magento processes customer PII, payment data, and order histories. A successful exploit gives attackers a foothold into one of the most data-rich environments in any organization.
Abuse of native functionality. The flaw leverages Magento's own template-processing and dependency-injection mechanisms — meaning traditional WAF rules may not catch the malicious traffic because it mimics legitimate template rendering and email generation activity.
Rust backdoor signals operational maturity. Threat actors are increasingly using compiled, memory-safe languages for Linux implants to evade PHP-focused detection. Rust binaries are less commonly fingerprinted by legacy EDR solutions.
Rapid exploitation timeline. The 50-minute window between first reported exploitation and a confirmed compromise suggests automated scanning and exploitation tooling is already in circulation.
The combination of unauthenticated access, native template abuse, and compiled backdoor deployment makes StyleSmuggler one of the most operationally significant e-commerce zero-days we've seen this year. Treat any unpatched Magento instance as a likely compromise candidate.
Who Is at Risk
Any organization running Adobe Commerce, Magento Open Source, or Adobe Commerce B2B on the affected versions is exposed. Highest-risk profiles include:
- Mid-market and enterprise e-commerce retailers with high transaction volume
- Storefronts running older 2.4.4–2.4.6 branches that may have delayed upgrade cycles
- Environments where Magento is internet-facing without a reverse proxy or WAF in front
- Merchants using third-party hosting providers who control patch deployment schedules
- B2B deployments with extended support contracts that may be running older B2B module versions
Immediate Actions
- Apply the VULN-39341 patch immediately. Download from Adobe's official repository and apply the version-appropriate patch. Do not wait for your next scheduled maintenance window.
- Rotate all encryption keys. Adobe explicitly requires this step — patching alone is insufficient. Rotate database encryption keys, JWT/API keys, and any merchant integration keys.
- Hunt for indicators of compromise. Search for unexpected PHP files in web roots, particularly droppers and web shells. Look for Rust-compiled binaries in /tmp, /var/tmp, or user home directories. Review outbound connections to unknown IP addresses or domains.
- Audit email template logs. Since the exploit generates a "Payment Transaction Failed Reminder" email, check your email sending logs for anomalous template rendering events or failed email dispatches that don't correspond to legitimate transactions.
- Review admin and API access. Attackers with RCE may have created persistence mechanisms — new admin users, modified ACL rules, or injected malicious modules into app/code or vendor directories.
Shield53 Recommendations
- Patch now, investigate in parallel. Do not delay patching to complete forensic review — apply the fix and rotate keys while simultaneously hunting for compromise artifacts.
- Deploy Magento-specific WAF rules. Generic WAF signatures won't catch template injection. Use rulesets from your WAF vendor that specifically target Magento template and email rendering endpoints.
- Implement file integrity monitoring on Magento core directories, especially
/app/code,/vendor,/pub/media, and/var. Alert on any new PHP files or unexpected binary uploads. - Restrict outbound traffic from Magento servers. The Rust backdoor connects to an external C2 server. Egress filtering would have blocked the callback even if initial exploitation succeeded.
- Validate your incident response runbook for e-commerce-specific scenarios. Ensure your team knows how to safely take a storefront offline, preserve forensic evidence, and communicate with payment processors if card data may have been exposed.
- Engage your payment partners proactively. If compromise is confirmed, notify your payment processor and acquiring bank immediately. PCI DSS reporting obligations may apply.
Shield53 assesses that exploitation of CVE-2026-75650 will accelerate over the coming days as proof-of-concept details circulate. Organizations that delay patching beyond 48 hours from Adobe's advisory should assume breach and act accordingly.
