- magento
- adobe-commerce
- rce
- cve-2026-75650
- ecommerce
- stylesmuggler
- kev
news
StyleSmuggler: Unauthenticated Magento / Adobe Commerce RCE (CVE-2026-75650)
Template-engine CWE-1336 unauth RCE (CVSS 10.0) exploited from 2026-09-04; Adobe hotfix VULN-39341 / APSB26-146 shipped 2026-09-07 — patch plus encryption-key rotation required.
Summary
StyleSmuggler (CVE-2026-75650) is a CVSS 10.0 unauthenticated remote code execution bug in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe’s CNA description is improper neutralization of special elements in a template engine (CWE-1336). Sansec tracked in-the-wild use from 2026-09-04 — three days before Adobe’s hotfix — planting backdoors on live stores. Disrex reported multiple victim shops. Adobe published APSB26-146 and hotfix VULN-39341 on 2026-09-07 (Priority 1) and stated it is aware of exploitation.
Sansec reproduced the unauthenticated chain on clean Magento Open Source 2.4.7 / 2.4.8 / 2.4.9. At least one confirmed victim was already current on the July/August 2026 Commerce security updates (security:patch-status clean). Being on 2.4.9-2026-aug is not a substitute for VULN-39341.
Public analysis describes attackers poisoning template paths through styles properties that slip past existing safeguards, then getting Magento to execute during render of the standard Payment Transaction Failed Reminder email path — no mailbox click required. OFFSITE.DARK does not document that chain as a procedure.
Key Findings
| Finding | Detail |
|---|---|
| CVE | CVE-2026-75650 |
| CVSS | 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) |
| Weakness | CWE-1336 — template engine special-element neutralization |
| Auth | None |
| First exploitation | 2026-09-04 (Sansec) |
| Vendor hotfix | VULN-39341 — 2026-09-07 — APSB26-146 |
| Affected (supported) | Adobe Commerce 2.4.4–2.4.9 (through 2026-aug); Magento OS 2.4.6–2.4.9; Commerce B2B 1.3.3–1.5.3 |
| Unsupported | Magento below 2.4.4 / Open Source below 2.4.6 — no Adobe hotfix; community backports exist |
| Post-patch | Rotate encryption keys and all secrets those keys wrapped |
Affected trains
Adobe lists August 2026 and earlier builds of:
- Adobe Commerce 2.4.4 through 2.4.9
- Magento Open Source 2.4.6 through 2.4.9
- Adobe Commerce B2B 1.3.3 through 1.5.3
The hotfix was tested against 2026-aug tags. Older-but-still-in-train stores should still apply VULN-39341 and verify with Quality Patches Tool (vendor/bin/magento-patches -n status). Stores below Adobe’s support floor need a backport (Scandiweb and others published version-specific patches back to 2.2) or an emergency upgrade.
Impact
- Unauthenticated PHP execution as the web user on the storefront — full site takeover, payment-skimmer / Magecart class follow-on, and access to encrypted config.
- Three-day zero-day window before the hotfix: patching is not incident response. Any store that was live from 2026-09-04 through 2026-09-07 needs compromise assessment.
- Scope-changed CVSS: impact extends beyond the vulnerable component (typical Magento: other tenants, adjacent services, stored secrets).
Mitigation
- Apply VULN-39341 immediately (composer-patch workflow per APSB26-146).
- Enable maintenance mode; suspend cron; rotate the Magento encryption key and every secret it may have wrapped: admin passwords, integration tokens, OAuth secrets, payment-gateway keys, database credentials, SSH keys.
- Hunt for web shells, unexpected template/block changes, and admin users created in the 2026-09-04 window.
- Unsupported versions: isolate from the internet until a backport or upgrade is in place.
- Do not treat APSB26-92 / APSB26-73 as covering this CVE.