“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways

Adobe disclosed CVE-2026-7565, dubbed “StyleSmuggler,” on September 7^th, 2026. The vulnerability, which received a maximal initial CVSS score of 10.0, affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated network-based attacker to execute arbitrary code by injecting PHP through Magento’s email template engine. Exploitation has been confirmed in the wild since at least September 4, 2026, with threat actors deploying a Rust-based Linux backdoor and PHP web shells on compromised storefronts. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on September 8, 2026. 

What do I need to know? 

• CVE: CVE-2026-75650 
• Severity: 10.0 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per Adobe vendor advisory 
• Attack Vector: Network — unauthenticated, no user interaction required 
• Root Cause: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336).  Attackers inject PHP via Magento’s template system, then trigger execution via a “Payment Transaction Failed Reminder” email. 
• Impact: Unauthenticated remote code execution 

Products and Systems Affected 

Affected Products  

Adobe Commerce versions: 

• <= 2.4.9-2026-aug  
• <= 2.4.7-2026-aug  
• <= 2.4.8-2026-aug  
• <= 2.4.6-2026-aug  
• <= 2.4.5-2026-aug  
• <= 2.4.4-2026-aug  

Adobe Commerce B2B versions: 

• <= 1.5.3-2026-aug 
• <= 1.5.2-2026-aug 
• <= 1.4.2-2026-aug 
• <= 1.3.4-2026-aug 
• <= 1.3.3-2026-aug 

Magento Open Source versions: 

• <= 2.4.9-2026-aug  
• <= 2.4.8-2026-aug 
• <= 2.4.7-2026-aug  
• <= 2.4.6-2026-aug 

What do I need to do? 

• Identify all Apache Commerce/Magento deployments in your environment and confirm the installed version against the affected ranges (see above). 
  • Any unpatched instance that was internet-exposed on or after September 4, 2026 should be treated as potentially compromised and investigated. 

• Apply the VULN-39341 Composer hotfix per Adobe bulletin APSB26-146. This is an emergency hotfix, not a full minor release.   

• Follow Adobe’s verification workflow to confirm successful hotfix application. 
  • Sansec has published host, network, and media-directory IOCs for CVE-2026-75650 — cross-reference against your environment. 

• Deploy WAF rules blocking template injection patterns targeting email generation endpoints.  
• Monitor for unusual PHP process spawning and unexpected outbound connections.  
• Any unpatched internet-exposed instance should be treated as compromised until proven otherwise — isolate and investigate. 

NetSPI Product and Services Coverage 

NetSPI’s Penetration Testing Services can assist with verifying exposure and validating your patching and remediation efforts. A version-based detection is offered by NetSPI’s Continuous External Attack Surface Management solution 

Additional Resources 

• NVD — CVE-2026-75650 
• MITRE – CVE-2026-75650 
• Adobe Security Advisory