StyleSmuggler Explained: CVE-2026-75650 Magento RCE Fix

A maximum-severity zero-day in Adobe Commerce and Magento Open Source let unauthenticated attackers run arbitrary code on live stores before a patch existed. Tracked as CVE-2026-75650 and nicknamed StyleSmuggler by the security firm that found it, the flaw was already being exploited for three days before Adobe shipped an emergency out-of-band fix on September 7. If you run Adobe Commerce or Magento Open Source, this is a patch-today situation, not a patch-this-sprint one.

Key Takeaways

• CVE-2026-75650 is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler by Sansec, the firm that discovered it.
• Sansec detected active exploitation starting September 4, 2026, and published its findings the next morning, before Adobe had issued a CVE, advisory, or patch.
• Adobe released an emergency hotfix (APSB26-146, priority rating 1) on September 7 rather than waiting for the next scheduled release.
• The exploit needs no authentication and no user interaction — it abuses Magento's own template system to run PHP when a routine payment-failure email renders.
• Attackers have deployed a self-updating Rust backdoor and separate PHP web shells; patching alone doesn't remove an existing backdoor, so credential rotation and a compromise check are required too.

What Is CVE-2026-75650 (StyleSmuggler)?

CVE-2026-75650 is a template-injection vulnerability in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker achieve arbitrary code execution. It carries the maximum CVSS score of 10.0. Sansec, the e-commerce security firm that found it, named it StyleSmuggler because the technique abuses Magento's "styles" template properties to slip past existing safeguards. Affected versions span Adobe Commerce and Magento Open Source 2.4.4 through 2.4.9, plus Adobe Commerce B2B 1.3.3 through 1.5.3.

How Does the Exploit Work?

The attack runs in two stages. First, the attacker injects malicious PHP into a location Magento's template engine will later process — for example, by generating a failed payment attempt. Second, they trigger Magento's standard "Payment Transaction Failed Reminder" notification. When Magento renders that email template, it executes the poisoned code. Critically, the code runs during template rendering itself, so the email doesn't even need to be successfully delivered for the exploit to succeed, and no customer or admin has to open anything.

Sansec reproduced the full attack chain on clean, unmodified Magento Open Source 2.4.7 through 2.4.9 installations, confirming it isn't dependent on other misconfigurations or plugins.

Who's Affected and What's the Real-World Impact?

Sansec first observed exploitation on September 4 and has since tracked at least two separate threat actors using the bug with different toolkits. One deploys a self-updating backdoor written in Rust that disguises its command-and-control traffic as ordinary NTP (time-sync) requests, making it harder to spot in network logs. A separate campaign drops a PHP web shell instead. Both let an attacker maintain access to a compromised store well after the initial break-in.

Reported estimates put more than 111,000 Adobe Commerce and Magento Open Source stores in active operation, and roughly one in five of the largest US retailers reportedly run Adobe Commerce, so the exposure isn't limited to small shops. If your store was running an affected version between September 4 and the time you apply the hotfix, treat it as a suspected compromise until you've confirmed otherwise, not just an unpatched vulnerability.

How Do You Patch It?

Adobe shipped the fix as a hotfix rather than a full point release. Download VULN-39341-composer-patches.zip from repo.magento.com and apply it as a composer patch:

composer require --dev cweagans/composer-patches

# apply the downloaded hotfix, then verify it registered:
vendor/bin/magento-patches -n status | grep "39341\|Status"

Adobe has only tested the hotfix against the August 2026 releases of the affected branches; it may work on other releases within 2.4.4–2.4.9, but Adobe hasn't confirmed compatibility beyond that baseline. If you're on an unsupported branch (2.2, 2.3, or 2.4.0–2.4.3), Adobe has not published a fix, though third-party backports exist from community contributors — Sansec notes those haven't been independently reviewed, so treat them as unverified.

What Should You Do After Patching?

Because attackers have had a real window to compromise stores before the fix existed, patching alone isn't sufficient. Adobe and Sansec both recommend: enable maintenance mode, suspend cron jobs, then rotate every secret the store holds — admin passwords, GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH keys, and any other API keys. Only after rotation should you flush the cache, restore cron execution, and disable maintenance mode. Also check for the specific indicators Sansec has published: unexpected outbound traffic disguised as NTP requests, and unfamiliar "Payment Transaction Failed Reminder" emails in your logs that you didn't generate through normal store activity.

Wrapping Up

StyleSmuggler is a reminder that unauthenticated template-injection bugs in widely deployed e-commerce platforms get weaponized within days, not weeks. If you run Adobe Commerce or Magento Open Source on any version from 2.4.4 to 2.4.9, apply the VULN-39341 hotfix now, then work through the credential-rotation checklist before you consider the incident closed.

Sources

Sansec: original StyleSmuggler research and indicators of compromise

Adobe: official APSB26-146 security bulletin

BleepingComputer: coverage of the backdoor and remediation steps

SecurityWeek: reporting on the wider Adobe September patch batch

The Hacker News: writeup on the exploit chain and backdoor