The short version
CVE-2026-75650, which Dutch e-commerce security firm Sansec calls StyleSmuggler, is a CVSS 10.0 unauthenticated remote code execution bug in Adobe Commerce and Magento Open Source — and it was already being exploited before Adobe shipped a fix. Attackers abuse Magento's template-processing logic to inject and run arbitrary PHP on the server, no account or click required. If your store runs a vulnerable build, the safe assumption is not “patch when convenient” but “assume you may already be breached.” For any business that treats its Magento storefront as its revenue engine, the fix and the compromise check are the same-day task.
What StyleSmuggler is
Sansec, the security firm that specializes in Magento, disclosed CVE-2026-75650 after catching it in live attacks. The flaw is a code-injection weakness in Magento's template engine: an attacker sends crafted input that the platform's template processing evaluates as PHP, handing them arbitrary code execution on the web server. The trigger path Sansec observed runs through the “Payment Transaction Failed Reminder” feature — a routine e-commerce email function that turns out to be reachable without authentication.
That combination is what makes it a worst-case bug for a public storefront. There is no login to bypass, no admin session to steal, no phishing step to get a user to click something. A store that is simply online and running a vulnerable build is exploitable by anyone who can reach it over the network. For most Magento shops — which exist precisely to be found and browsed by the public — that means the attack surface is the entire internet.
Adobe assigned the issue its highest priority and shipped an out-of-band hotfix, tracked internally as VULN-39341, on September 8, 2026. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog and set a federal remediation deadline of September 11 — the kind of short fuse CISA reserves for flaws under active attack.
Why it scores a perfect 10
A CVSS base score of 10.0 is not handed out often; it requires the vulnerability to be bad on every axis the model measures. StyleSmuggler qualifies on all of them: the attack comes over the network, the attack complexity is low, it needs no privileges, and it requires no user interaction — and a successful exploit can fully compromise the confidentiality, integrity and availability of the affected system.
Translated out of the scoring vocabulary, that means a remote, anonymous attacker can take complete control of the server with a single request, and everything the store touches is exposed: customer records, order history, saved payment metadata, admin accounts, and the database credentials the application holds. On a Magento box, remote code execution is effectively game over, because the web process can read the app's secrets and reach the database directly.
Adobe lists the affected releases as Adobe Commerce 2.4.4 through 2.4.9 (the 2026-aug builds and earlier), Adobe Commerce B2B in the 1.3.3–1.5.3 range, and Magento Open Source 2.4.6 through 2.4.9. That range covers the vast majority of live Magento estates, including the self-hosted Open Source deployments that smaller merchants and agencies run without a dedicated security team watching them.
How it was exploited before the patch
The detail that should reset your risk model is the timeline. Sansec confirmed exploitation starting September 4, 2026 — four days before Adobe had a fix to offer. This was a genuine zero-day: for that window, there was no patch to apply and no vendor advisory to act on, only attackers quietly getting in. Any store that was internet-facing and unpatched during those days should be treated as potentially compromised, not merely “at risk.”
What the attackers did once inside is the part that outlasts the patch. Sansec reported two payload families: a Rust-based Linux backdoor that connects out to external command-and-control servers for persistent remote access, and, in separate intrusions, a PHP web shell that lets the operator run arbitrary PHP commands through the store itself. Both are designed to survive a later update — a backdoor dropped in early September does not remove itself when you install the September 8 hotfix.
That is why the official remediation guidance goes beyond patching. Because attackers may have already read the store's secrets, defenders are told to rotate encryption keys and all associated credentials — admin passwords, database credentials, integration tokens, SSH keys and API keys — at their source systems. If a Magento box was open during the exposure window, its keys should be considered burned.
What it means for US & EU e-commerce teams
First, treat this as an incident-response exercise, not a patch cycle. The instinct on patch-day news is to schedule the update and move on; StyleSmuggler breaks that instinct because exploitation predated the fix. The right sequence for any e-commerce operator running Magento is: apply the hotfix immediately, then assume the store may have been reached and hunt accordingly. A clean patch on a box that was already backdoored is a false sense of safety.
Second, weigh the compliance clock alongside the technical one. A Magento store processes cardholder data and personal data, which puts it squarely under PCI DSS and, for EU customers, GDPR. If evidence shows attackers accessed customer or payment data, notification obligations can start ticking from the moment you become aware — and under GDPR that can mean a 72-hour window to notify a supervisory authority. The exposure assessment is therefore not optional cleanup; it is what tells you whether you have a reportable breach.
Third, be honest about who is watching the store. Plenty of merchants run Magento Open Source on their own infrastructure with an agency that built the site years ago and a hosting provider that patches the OS but not the application. That gap — nobody clearly owning application-layer security — is exactly where a pre-auth RCE turns into a months-long compromise. If your team cannot answer “what version are we on, was it exposed on September 4, and what would a web shell look like on our host,” that is the gap to close first, ideally with engineers who understand both Magento internals and the infrastructure around it.
A patch-and-hunt checklist
- Confirm your version. Identify the exact Adobe Commerce or Magento Open Source build in every environment and flag anything in the 2.4.4–2.4.9 range that was internet-facing.
- Apply VULN-39341 now. Install Adobe's out-of-band hotfix for CVE-2026-75650, then verify the patched version is actually the one running, not just downloaded.
- Assume compromise if you were exposed. If the store was reachable and unpatched during September 4–8, run incident response rather than declaring victory at patch time.
- Rotate everything. Change encryption keys, admin passwords, database credentials, integration tokens, SSH keys and API keys at their source systems.
- Hunt for persistence. Look for unexpected PHP files and web shells, unfamiliar cron jobs, new admin users, and outbound connections to unknown hosts (the Rust backdoor's calling card).
- Check the compliance path. If customer or payment data may have been reached, engage your PCI DSS and GDPR breach-notification process before the clock forces the decision.
Frequently asked questions
What is the Magento StyleSmuggler vulnerability (CVE-2026-75650)?
CVE-2026-75650, dubbed StyleSmuggler by security firm Sansec, is a CVSS 10.0 code-injection flaw in Adobe Commerce and Magento Open Source that allows unauthenticated remote code execution. Attackers abuse Magento's template-processing logic, reachable through the Payment Transaction Failed Reminder feature, to inject and run arbitrary PHP on the server. Because it needs no valid account and no user interaction, any internet-facing store on a vulnerable build should be treated as a high-priority target.
Which Adobe Commerce and Magento versions are affected?
According to Adobe's advisory, affected versions include Adobe Commerce 2.4.4 through 2.4.9 (the 2026-aug releases and earlier), Adobe Commerce B2B (1.3.3 through 1.5.3), and Magento Open Source 2.4.6 through 2.4.9. Adobe released an out-of-band, Priority 1 fix (VULN-39341) on September 8, 2026, and stores should apply it immediately.
Is CVE-2026-75650 being exploited in the wild?
Yes. Sansec confirmed active exploitation beginning September 4, 2026, several days before Adobe's fix. Attackers deployed a Rust-based Linux backdoor that connects to external command servers and, in separate attacks, a PHP web shell capable of running arbitrary PHP commands. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 8, with a federal remediation deadline of September 11, 2026.
Is patching enough, or do I need to do more?
Patching stops new intrusions but does not undo a compromise that already happened during the exposure window. Because the zero-day was exploited before the fix existed, vulnerable stores should assume potential compromise: apply the VULN-39341 hotfix, then rotate encryption keys and all associated credentials, including admin passwords, database credentials, integration tokens, SSH keys and API keys. Hunt for unexpected PHP files, cron jobs and outbound connections, and review orders and admin users created since early September.
Sources
Adobe — Security update available for Adobe Commerce (APSB26-52, CVE-2026-75650)
The Hacker News — Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell (September 2026)
SecurityWeek — Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day (September 8, 2026)