Adobe has released emergency security updates for Adobe Commerce and Magento Open Source to address a maximum-severity vulnerability that is being actively exploited against online stores.
Tracked as CVE-2026-75650 with a CVSS score of 10.0, the vulnerability has been dubbed StyleSmuggler by security firm Sansec. Researchers said they detected zero-day exploitation beginning September 4, 2026.
Adobe confirmed the active exploitation in its security bulletin, warning that the flaw could allow attackers to execute arbitrary code on vulnerable systems.
“This update resolves a critical vulnerability that could result in arbitrary code execution,” Adobe said, noting that it is aware of exploitation targeting Adobe Commerce merchants.
Critical Magento Vulnerability Enables Code Execution
The vulnerability involves Magento’s template-processing functionality.
According to security researchers, attackers can abuse the system to inject PHP code and trigger the generation of a “Payment Transaction Failed Reminder” email. The malicious template processing ultimately allows arbitrary code to execute on the affected server.
Because the vulnerability can potentially be exploited without authentication, compromised Magento stores could be exposed to complete server-side compromise.
Affected Adobe Commerce and Magento Versions
Adobe says the vulnerability affects multiple branches of its Commerce and Magento Open Source platforms.
Adobe Commerce
Affected versions include:
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
- 2.4.5-2026-aug and earlier
- 2.4.4-2026-aug and earlier
Adobe Commerce B2B
Affected versions include:
- 1.5.3-2026-aug and earlier
- 1.5.2-2026-aug and earlier
- 1.4.2-2026-aug and earlier
- 1.3.4-2026-aug and earlier
- 1.3.3-2026-aug and earlier
Magento Open Source
Affected versions include:
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
Adobe Releases Emergency Hotfix
Adobe has made a hotfix available to address the vulnerability.
Administrators running affected versions are required to apply the appropriate VULN-39341 patch. Adobe also recommends rotating encryption keys as part of the remediation process.
Adobe said:
“To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys.”
Organizations should prioritize the fix because the vulnerability is already being exploited in real-world attacks.
Attackers Deploy Backdoors on Compromised Magento Servers
The active exploitation campaign appears to involve multiple payloads.
Sansec reported that attackers are exploiting CVE-2026-75650 to install a Rust-based Linux backdoor. The malware connects to an external server and waits for additional commands from the attacker.
In separate attacks, researchers observed the vulnerability being used to deploy a PHP dropper. The dropper can write a web shell to the compromised server, giving attackers a way to execute arbitrary PHP code.
These capabilities could allow attackers to maintain access to compromised e-commerce infrastructure and potentially steal sensitive information or manipulate online stores.
Magento Stores Compromised Within Minutes
The severity of the campaign is highlighted by observations from Netherlands-based security company Disrex.
According to the company, a Magento server operated by an e-commerce development platform was compromised approximately 50 minutes after the first confirmed StyleSmuggler exploitation was reported.
The initial exploitation was reported on September 4, 2026, at approximately 10:20 p.m. UTC.
Disrex described the vulnerability as an unauthenticated remote-code-execution chain that abuses Magento’s own template-processing and dependency-injection functionality.
“StyleSmuggler turns Magento’s own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain,” Disrex said.
Magento Administrators Should Act Immediately
Because CVE-2026-75650 carries a 10.0 CVSS rating and has already been exploited in the wild, administrators should treat the issue as an urgent security incident rather than a routine software update.
Organizations running affected Adobe Commerce or Magento Open Source installations should:
- Apply the appropriate VULN-39341 hotfix immediately.
- Rotate Magento encryption keys as recommended by Adobe.
- Check servers for unauthorized PHP files and web shells.
- Investigate unexpected processes, accounts and outbound network connections.
- Review logs for suspicious requests and signs of exploitation.
- Inspect systems for persistence mechanisms or newly installed backdoors.
- Consider incident-response procedures if compromise is suspected.
The active exploitation of StyleSmuggler demonstrates the risk posed by vulnerabilities in internet-facing e-commerce platforms. Since Magento installations frequently handle customer information and payment-related operations, a successful compromise can have serious consequences for both merchants and their customers.
