Adobe Patches Critical StyleSmuggler Zero-Day Exploited in Magento (CVE-2026-75650)

Adobe has released emergency hotfixes to address a maximum-severity zero-day vulnerability in Adobe Commerce and Magento Open Source platforms. Tracked as CVE-2026-75650 with a CVSS score of 10.0, the vulnerability has been codenamed StyleSmuggler by e-commerce security firm Sansec, which detected active in-the-wild exploitation beginning September 4, 2026. Unauthenticated attackers are abusing the flaw to achieve remote code execution (RCE) on vulnerable store infrastructure, deploying Rust-based Linux backdoors and persistent PHP web shells.

Given the widespread adoption of Magento across global retail and online platforms, store operators should treat this update as an immediate emergency patching priority.

Overview of the Zero-Day Exploitation

The vulnerability represents an unauthenticated template injection chain that allows remote attackers to execute arbitrary code on the underlying operating system without requiring valid user accounts or store privileges. Sansec discovered initial zero-day attacks on September 4, 2026. Dutch e-commerce security firm Disrex noted that automated threat campaigns moved rapidly following disclosure; a managed Magento server was compromised just 50 minutes after the first confirmed exploitation was recorded at 10:20 p.m. UTC that same evening.

Adobe has acknowledged the active attacks, confirming that threat actors are targeting merchants operating both Adobe Commerce and open-source Magento instances. Because automated exploit scripts can target exposed endpoints across the internet without pre-existing access, vulnerable platforms face near-immediate compromise if exposed to incoming traffic.

Technical Breakdown: How StyleSmuggler Works

StyleSmuggler leverages weaknesses categorized under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). In Magento’s architecture, email templates and dynamic layout directives rely on standard template processing and dependency-injection mechanics to render store communications.

In this attack vector, adversaries inject crafted PHP code directives directly into Magento’s template processing logic while generating a specific system transactional message: the “Payment Transaction Failed Reminder” email. When the platform attempts to compile or parse the email template structure, the malicious directives trick the dependency injection framework into evaluating injected PHP commands.

The severity of CVE-2026-75650 is reflected in its CVSS metrics (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H):

• Attack Vector & Complexity (AV:N/AC:L): The attack is remotely reachable over the network and requires minimal attack complexity or specialized conditions.
• Privileges & Interaction (PR:N/UI:N): No authentication credentials or administrative roles are required, nor does the attack require any interaction from store shoppers or administrators.
• Scope Changed (S:C): Crucially, the vulnerability breaches the execution boundary of the template engine itself, allowing commands to run directly in the broader host web server context.
• Impact (C:H/I:H/A:H): Attackers gain full control over data confidentiality, system integrity, and service availability on the host.

Attack Payloads and Immediate Blast Radius

Observed exploitation campaigns indicate attackers are deploying two distinct post-exploitation payloads:

1. Rust-Based Linux Backdoor: Adversaries deploy a compiled binary written in Rust to the host Linux server. Rust offers attackers cross-architecture speed, memory efficiency, and improved evasion against traditional signature-based security tools. Once executed, the backdoor establishes persistent outbound connections to an external command-and-control (C2) server, waiting for remote administrative commands.
2. PHP Dropper and Web Shell: Separately, attackers deploy a lightweight PHP dropper script that writes persistent web shells onto public web directories. This grants attackers secondary, direct web access to execute arbitrary PHP code even if network connections to the main Rust backdoor are disrupted.

The blast radius for e-commerce organizations compromised by StyleSmuggler is severe. Gaining full code execution on a Magento web server allows attackers to read, alter, or exfiltrate store databases containing customer personal data, transaction histories, and order details. Furthermore, full server control enables threat actors to inject malicious JavaScript payment skimmers (Magecart attacks) directly into payment checkout pages to capture live payment card details at checkout.

Required Remediation and Key Rotation Steps

To mitigate CVE-2026-75650, administrators must apply Adobe’s official hotfix patch and perform key rotation immediately:

• Apply Hotfix Patch VULN-39341: Download and deploy the vendor hotfix patch corresponding to your environment version using Composer (repo.magento[.]com/patch/VULN-39341-composer-patches.zip).
• Rotate Application Encryption Keys: Adobe explicitly mandates that merchants rotate their Magento application encryption keys (env.php) immediately after applying the patch. If an environment was accessed by attackers prior to patching, compromised encryption keys could allow attackers to forge session tokens or decrypt protected configuration data post-patch.
• Inspect Systems for Post-Exploitation Indicators: Review running system processes for unauthorized Rust binaries, audit server file systems for newly created .php files in web-accessible directories, and analyze network egress logs for unexpected outbound connections initiated on or after September 4, 2026.