---
schema: 1
kind: vulnerability
title: "CVE-2026-75650 (\"StyleSmuggler\") — Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed"
headline: "Adobe rates its own emergency hotfix priority 1 for a flaw stores were already being compromised through since before Sansec published"
summary: >
  Sansec disclosed StyleSmuggler on 2026-09-05 after finding active exploitation from 2026-09-04:
  an unauthenticated remote-code-execution chain in Magento Open Source, Adobe Commerce and Adobe
  Commerce B2B (all versions 2.4.4 through 2.4.9), assigned CVE-2026-75650 (CVSS 10.0). Adobe shipped
  an emergency hotfix (APSB26-146) on 2026-09-07, three days after the first confirmed compromise;
  patch level gave no protection during that window, and Adobe recommends rotating every credential
  the encryption key protects.
discovered_at: "2026-09-08T04:39:00Z"
updated_at: null
event_date: "2026-09-04"
run_id: 2026-09-08T0411Z-intel
priority: critical
immediate_action:
  title: "Patch Magento/Adobe Commerce now and assume compromise until scanned"
  action: >
    Apply Adobe's VULN-39341 hotfix (APSB26-146) to every Adobe Commerce, Adobe Commerce B2B and
    Magento Open Source instance today, regardless of patch level — a fully patched 2.4.6-p15
    store was compromised before the hotfix existed, and moving session storage to Redis or a
    database does not stop the attack. Where the hotfix cannot be applied immediately, Sansec's
    own interim advice for stores not running its Shield product is to temporarily disable
    GraphQL, since the observed chain arrives via a `POST /graphql` request; note this breaks
    headless and progressive-web-app storefronts, which depend on GraphQL, though most classic
    and Hyvä storefronts do not. Before assuming a store is clean, hunt for a background
    process masquerading as a kernel worker thread, `fc-cache` or `chronyd`, and for a cron entry
    written directly into the spool file rather than through the crontab command (an empty
    `crontab -l` is not evidence of a clean host). Where an implant is found, rotate the store's
    encryption key and every credential it protects — admin passwords, REST/SOAP/GraphQL tokens,
    OAuth secrets, payment-gateway API credentials, database and SSH/deploy keys — at the source
    system, since rotating the encryption key alone does not invalidate anything already read.
tags: [vulnerabilities, rce, actively-exploited, zero-day, pre-auth, patch-available]
regions: [global, europe, switzerland]
sectors: [public-sector, retail]
entities: ["trend:stylesmuggler-magento-adobe-commerce-2026-09"]
techniques: [T1190, T1053.003, T1036.005, T1001.003, T1622, T1505.003, T1071.004, T1082]
affected_products: ["Adobe Commerce", "Adobe Commerce B2B", "Magento Open Source"]
cves:
  - id: CVE-2026-75650
    cvss: "10.0"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [exploited, poc-public, patch-available]
    affected: "Adobe Commerce, Magento Open Source 2.4.4 through 2.4.9 (all 2026-aug patch levels and earlier); Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug patch levels and earlier)"
    fixed: "Hotfix VULN-39341 (composer patch, not a full point release), released 2026-09-07"
sources:
  - url: "https://sansec.io/research/stylesmuggler-0day"
    publisher: "Sansec Forensics Team"
    date: "2026-09-05"
    role: primary
  - url: "https://helpx.adobe.com/security/products/magento/apsb26-146.html"
    publisher: "Adobe PSIRT (APSB26-146)"
    date: "2026-09-07"
    role: primary
  - url: "https://security-hub.ncsc.admin.ch/#/posts/12915"
    publisher: "NCSC Switzerland / GovCERT.ch — Cyber Security Hub"
    date: "2026-09-07"
    role: corroborating
  - url: "https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html"
    publisher: "The Hacker News"
    date: "2026-09-06"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Sansec is publishing early because stores are being compromised right now."
    publisher: "Sansec Forensics Team"
    source_url: "https://sansec.io/research/stylesmuggler-0day"
  - quote: "Adobe is aware of CVE-2026-75650 being exploited in the wild."
    publisher: "Adobe PSIRT (APSB26-146)"
    source_url: "https://helpx.adobe.com/security/products/magento/apsb26-146.html"
  - quote: "The fix ships as a hotfix, not as a full release."
    publisher: "Sansec Forensics Team"
    source_url: "https://sansec.io/research/stylesmuggler-0day"
  - quote: "Moving sessions to Redis or the database does not stop the attack. One merchant reported an attempt that failed against session storage and, eight seconds later, a second attempt that succeeded by using a file uploaded through Magento's custom options instead."
    publisher: "Sansec Forensics Team"
    source_url: "https://sansec.io/research/stylesmuggler-0day"
  - quote: "Successful exploitation allows unauthenticated attackers to achieve remote code execution and establish persistent backdoors on affected e-commerce servers via network access."
    publisher: "NCSC Switzerland / GovCERT.ch — Cyber Security Hub"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/12915"
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: true
deep_dive_category: web-app-rce
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Patch every Adobe Commerce, Adobe Commerce B2B and Magento Open Source instance to the VULN-39341 hotfix now, then hunt for a masquerading background process (kernel-worker-style name, fc-cache, or chronyd) and a cron entry written directly to the spool file before concluding the store is clean; rotate the encryption key and every credential it protects if either is found."
updates: []
migrated_from: null
---

Sansec found StyleSmuggler on 2026-09-04 at 22:40 UTC and published the following day specifically because stores were already being compromised, reproducing the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9 within hours ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). The bug abuses Magento's own template engine through the `styles` property, reached via a `POST /graphql` request carrying the malicious `styles` parameter, to smuggle PHP past existing input safeguards, and runs in two stages: first the attacker poisons a location Magento itself writes to and later re-renders through its template filter — Sansec's own published check searches a failure report under `var/report/`, but Magento hosting firm Disrex Group, which handled two live compromises, found both of its infections instead poisoned `var/log/system.log`, a location Sansec's check misses entirely ([The Hacker News, 2026-09-06](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html)) — with attacker-controlled PHP; second, the attacker triggers Magento's built-in "Payment Transaction Failed Reminder" customer-notification email, and the poisoned content executes the moment Magento renders that template ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Nobody needs to open the email, and the attack succeeds even when delivery fails ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Adobe assigned CVE-2026-75650 (CVSS 10.0, CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine) and shipped an emergency hotfix, APSB26-146, on 2026-09-07 at 20:20 UTC with its highest priority rating, three days after the first confirmed exploitation ([Adobe PSIRT, 2026-09-07](https://helpx.adobe.com/security/products/magento/apsb26-146.html); [Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). The fix ships as a composer patch (`VULN-39341`) rather than a full point release, tested against the 2026-aug release branch of Adobe Commerce, Adobe Commerce B2B and Magento Open Source 2.4.4 through 2.4.9; older versions in those branches are affected too, but Sansec reports the patch is unverified there ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)).

Disrex's own two compromises, reported independently of Sansec, sharpen the timeline and the triage picture. Both stores were breached inside the roughly eight-hour window between Sansec's first observed exploitation and the moment any defense existed, and Disrex states patch level was irrelevant during that window — one victim ran Magento Open Source 2.4.8 as a Sansec Shield customer with the module installed, enabled and licensed, and was still hit hours before Shield's first blocking rule went live ([The Hacker News, 2026-09-06](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html)). Disrex reports a concrete false-negative worth defenders' attention: its own eComscan run on one compromised store returned clean eleven hours after the implant first executed, because the scheduled scan was scoped to the store's document root while the implant had installed itself one directory above it, under the site account's home directory — a scan-scope gap, not a detection-engine failure. Disrex also names a reliable success indicator the exploit itself leaves behind: a `TypeError` from `array_merge()` with an integer argument, logged immediately after the poisoned include executes; a stealthier variant instead returns an empty array and leaves nothing to find, so its absence does not clear a host. One of Disrex's two compromises first surfaced through exactly the "Payment Transaction Failed Reminder" tell this entry describes above: a merchant forwarded a failed-transaction email whose template variables had never resolved — raw `{{var ...}}` tags, a customer address on an invalid domain, a zero-value total — and that forward alone started the investigation that found the implant within the hour ([The Hacker News, 2026-09-06](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html)).

Patch level offered no protection during the exposure window: the first confirmed victim ran Magento 2.4.6-p15 with the July and August 2026 security patches applied — the latest patch level Adobe offers for that release line — and a clean `security:patch-status` ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day); [The Hacker News, 2026-09-06](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html)), and Sansec's own Shield product blocked a probe against an already-current 2.4.7-p10 store on 2026-09-07, confirming that current patch level was no defense during the exposure window ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Moving session storage to Redis or a database is not a mitigation either: one merchant's session-storage defense stopped one attempt, and the same operator succeeded eight seconds later by routing the poisoned payload through a file uploaded via Magento's custom options instead ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). On success, the implant is a small Rust binary — Disrex describes the sample from its own compromises as stripped and statically linked — that installs itself under a hidden directory outside the web root and re-persists via a cron entry written directly into the cron spool file rather than through the crontab command, so the change leaves no corresponding audit line and an empty `crontab -l` is not evidence of a clean host ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day); [The Hacker News, 2026-09-06](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html)). The implant renames its own process to masquerade as a kernel worker thread, the fontconfig cache builder, or the genuine NTP daemon, and one observed build re-dropped and renamed itself mid-run from one masquerade to another while keeping the same underlying agent identity — a process-naming change with no corresponding new infection ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). It reads `/proc/self/status` for `TracerPid` before beaconing: if a debugger or tracer is attached, the implant still installs itself but never calls out, which matters for anyone attempting to reproduce or analyze it live ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)).

Command-and-control is disguised as time synchronization: every 60 seconds the implant sends short UDP datagrams to port 123 shaped to resemble NTP server replies, carrying a chunked telemetry record (host, user, operating system, resource usage, and implant version) rather than legitimate time data — traffic that passes most egress filtering unremarked because it looks like a routine NTP exchange ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Two details separate it from a genuine NTP client for a defender who does look: a real client issues one query per interval, where one observed build burst nine datagrams roughly ten milliseconds apart every sixty seconds; and every datagram is marked NTP server-mode, which a client has no legitimate reason to send at all ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Sansec has so far found no evidence the backdoor has been used beyond installation and beaconing ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)).

Sansec separately documents a second, apparently unrelated actor exploiting the same flaw: a reconnaissance probe sent as an ordinary-looking GraphQL request carries PHP code inside a request header rather than the request body, reads the host's kernel/OS string, PHP user, working directory, and whether the media directory is writable, then exfiltrates that single-line answer one fragment at a time as a sequence of externally-resolved hostname labels to a public callback service — a technique that needs no response body at all, since the operator reconstructs the answer from the callback log ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)). Only when that probe reports the media directory writable does the same actor follow up with a web shell planted inside the product-image cache directory, reachable solely with a custom request header ([Sansec, 2026-09-05](https://sansec.io/research/stylesmuggler-0day)).

Every version of Adobe Commerce, Adobe Commerce B2B and Magento Open Source in the 2.4.4–2.4.9 line is affected with no authentication or user interaction required ([Adobe PSIRT, 2026-09-07](https://helpx.adobe.com/security/products/magento/apsb26-146.html)); Switzerland's NCSC has issued its own advisory confirming the exploitation and backdoor-persistence risk for its constituency ([NCSC Switzerland / GovCERT.ch, 2026-09-07](https://security-hub.ncsc.admin.ch/#/posts/12915)). Any public body or supplier running a storefront, ticketing portal or fee-payment system on this platform — tourism boards, cantonal shops, public-transport ticketing among them — is in the affected population even without a Swiss-specific victim yet reported.

**Defender takeaway:** patch to the VULN-39341 hotfix immediately regardless of current patch level, then assume compromise until proven otherwise: hunt for the masquerading background process and for a cron entry that bypasses `crontab`'s own logging before trusting a clean scan, and follow Adobe's full credential-rotation checklist — starting with the store's encryption key — for any host where either is found, since rotating the key alone does not invalidate anything an attacker already read.

**Triage:** the exploitation trigger is Magento's own "Payment Transaction Failed Reminder" email, so an unexplained burst of these messages — especially containing unresolved template placeholders or Magento's template-error fallback text — is a Magento-specific tell that costs no additional tooling to check; legitimate declined-payment traffic can produce the same notification, so treat the burst as a lead, not a confirmation. On the network side, a web-tier host that only ever needs outbound HTTPS suddenly emitting repeated small UDP datagrams to port 123 is not a legitimate NTP client, which issues a single periodic query rather than a burst of server-mode replies; filtering by process name alone is insufficient once an implant has renamed itself to match the very daemon a defender would otherwise exclude from suspicion.