Adobe Fixes Critical Magento Zero-Day Exploited in Server Hijacking Attacks

E-commerce platforms running Adobe Commerce and Magento Open Source are facing active exploitation due to an unauthenticated remote code execution zero-day vulnerability dubbed StyleSmuggler. Tracked as CVE-2026-75650, the max-severity flaw allows remote attackers to bypass security controls and gain full execution privileges on affected web servers without requiring prior authentication or user interaction. Threat intelligence from e-commerce security firm Sansec confirmed that active exploitation began on September 4, prompting Adobe to issue an emergency hotfix (VULN-39341). With multiple threat groups deploying persistent Linux backdoors and web shells against vulnerable stores, store administrators must apply emergency mitigations immediately.

Technical Mechanics of CVE-2026-75650

The vulnerability is categorized under CWE-1336, which covers improper neutralization of special elements within a template engine. In Adobe Commerce and Magento installations, template processing components manage dynamic content rendering across custom themes, store layouts, and transactional email messaging. By supplying malicious input to vulnerable endpoints, an unauthenticated attacker can force the underlying template engine to process raw code outside the sandbox context, resulting in arbitrary PHP execution at the operating system user level.

The CVSS v3.1 vector for this flaw—CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H—highlights its severe risk profile. The vulnerability is accessible directly over the network (AV:N), requires low attack complexity (AC:L), needs zero privileges (PR:N), and demands no user interaction (UI:N). Crucially, the Scope metric is changed (S:C), indicating that successful exploitation allows the threat actor to break out of the local application boundary and compromise the hosting infrastructure, relational databases, or adjacent environment services.

Although the EPSS (Exploit Prediction Scoring System) probability is currently registered at 0.68% (putting it in the 50th percentile of scored vulnerabilities), this baseline statistical model reflects automated scanning metrics rather than active zero-day campaigns. Because live exploitation has been confirmed in production environments, the EPSS score should be disregarded in favor of emergency response protocols.

In-The-Wild Exploitation and Malware Payloads

Sansec’s threat research identified multiple threat actors leveraging CVE-2026-75650 across separate campaigns. The initial campaign, active since early September, uses the flaw to plant a persistent Linux backdoor designed to establish stealthy command-and-control (C2) channels. To avoid network detection, the backdoor disguises its C2 host header as a benign Network Time Protocol (NTP) server. Despite this obfuscation, infected stores often exhibit operational anomalies, such as automated background generation of unauthorized “Payment Transaction Failed Reminder” emails sent directly to customers.

A secondary campaign involving a distinct threat actor has also been observed exploiting the flaw to drop a 485-byte lightweight PHP web shell. This payload carries out automated post-exploitation tasks:

1. Audits server environmental variables and system configurations.
2. Checks whether the application’s public media directory (pub/media) possesses active write permissions.
3. Exfiltrates system metadata by making outbound HTTP requests to custom subdomains on oast.site—an infrastructure domain belonging to the open-source Interactsh Out-of-Band Application Security Testing (OAST) framework.

The deployment of simple web shells alongside complex C2 backdoors indicates that technical details of the vulnerability are diffusing quickly across criminal ecosystems targeting payment card data.

Scope of Affected Systems

The zero-day vulnerability affects a wide range of current e-commerce product branches:

• Adobe Commerce: Versions 2.4.4 through 2.4.9 (including August 2026 releases and earlier versions in each branch).
• Adobe Commerce B2B: Versions 1.3.3 through 1.5.3 (including August 2026 releases and earlier versions in each branch).
• Magento Open Source: Versions 2.4.6 through 2.4.9 (including August 2026 releases and earlier versions in each branch).

Because Magento and Adobe Commerce drive critical business infrastructure, arbitrary code execution exposes online stores to digital credit card skimmers (Magecart attacks), customer database theft, API key compromise, and host takeover.

Mandatory Remediation and Hardening Protocol

Adobe released security advisory APSB26-146 and assigned it the vendor’s highest priority rating, urging store operators to apply hotfix VULN-39341 immediately. Adobe notes that while the hotfix was strictly tested against the August 2026 releases, compatibility with unpatched earlier versions within affected branches cannot be guaranteed without full testing.

Because persistent web shells or backdoors may have been established prior to patching, engineering teams must execute a comprehensive incident response and cleanup workflow:

1. Place Store in Maintenance Mode: Take the application offline to block external incoming HTTP requests during maintenance.
2. Suspend System Cron Jobs: Temporarily disable scheduled task runners (cron) to stop persistent malware scripts or automated exfiltration routines from executing in the background.
3. Apply Emergency Patch VULN-39341: Install the vendor-supplied hotfix according to Adobe’s patch management steps.
4. Rotate All Infrastructure and Application Secrets: Assume existing credentials are compromised and rotate:
   • Magento administrator account passwords and SSH access keys.
   • GraphQL integration tokens and OAuth client secrets.
   • Payment gateway API credentials, merchant keys, and database passwords.
   • Third-party integration API keys and webhooks.
5. Inspect Application Files and Flush Cache: Scan file structures—specifically verifying write-accessible locations such as pub/media—for rogue 485-byte PHP web shells or unexpected code. Clear application caches, re-enable system cron jobs, and bring the store out of maintenance mode.

Security operations teams should also check network logs for outbound requests pointing to .oast.site domains and audit transactional mail queues for anomalous payment failure messages to confirm whether their environment was targeted prior to hotfix installation.