Executive Summary
CVE-2026-75650 (nicknamed StyleSmuggler by Sansec) is a critical unauthenticated remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, rated CVSS 3.1 10.0 (CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine). Adobe published Priority-1 security bulletin APSB26-146 on September 7, 2026 with hotfix VULN-39341 and stated it is aware of in-the-wild exploitation. Sansec reported first confirmed exploitation on September 4, 2026 at 22:20 UTC.
CISA added CVE-2026-75650 to the Known Exploited Vulnerabilities catalog on September 8, 2026, with a federal remediation due date of September 11, 2026, forensic triage required = Yes, and known ransomware campaign use = Unknown. NVD status is Analyzed (published September 7, 2026; lastModified September 9, 2026).
Adobe’s Experience League guidance is explicit: apply the hotfix and rotate the Magento encryption key plus all credentials that key protects (integration tokens, payment gateway APIs, database, SSH/deploy, extension keys) at source. Rotating the encryption key alone does not invalidate already-exposed credentials. Patch-only responses are insufficient for residual risk.
Technical Information
CVE-2026-75650 is an unauthenticated template-engine injection flaw enabling arbitrary code execution with changed scope. Public research (Sansec, The Hacker News, Tenable) describes an unauthenticated chain involving Magento template / styles injection and failed-payment email rendering pathways. This advisory does not reproduce exploit steps.
Exploitation timeline (sourced):
- September 4, 2026 22:20 UTC — Sansec first confirmed StyleSmuggler exploitation; eComscan later flagged implants on unrelated stores.
- September 5, 2026 — Sansec reproduced the unauthenticated chain on clean Magento Open Source 2.4.7 / 2.4.8 / 2.4.9 and published analysis; Shield blocking reported from ~07:15.
- September 6–7, 2026 — Post-compromise implant process names observed shifting (e.g., fc-cache, chronyd variants per Sansec); a second, unrelated actor reportedly dropped PHP web shells on some victims.
- September 7, 2026 ~20:20 UTC — Adobe published APSB26-146 and hotfix VULN-39341; stated awareness of wild exploitation.
- September 8, 2026 — CISA KEV addition (due September 11, 2026; forensic triage Yes). Cloudflare and Imperva WAF rules were later reported (Sansec, September 10).
- September 9+ — Sansec reported additional post-exploitation toolkits on some compromised stores (investigation ongoing as of their September 14, 2026 update).
Adobe APSB26-146 acknowledgements list researchers for other CVEs in the bulletin and do not attribute CVE-2026-75650 on-bulletin. No named APT attribution appears in Adobe, CISA, NVD, Sansec, Tenable, or The Hacker News sources reviewed for this pack. Do not invent ATT&CK technique IDs—none were published by those primary sources as of September 15, 2026.
Affected Product Versions
Vendor: Adobe. Products: Adobe Commerce; Adobe Commerce B2B; Magento Open Source. Prefer the official Adobe matrix over secondary shorthand.
Adobe Commerce (APSB26-146 / Experience League):
- 2.4.9-2026-aug and earlier; 2.4.8-2026-aug and earlier; 2.4.7-2026-aug and earlier; 2.4.6-2026-aug and earlier; 2.4.5-2026-aug and earlier; 2.4.4-2026-aug and earlier — all platforms
Adobe Commerce B2B:
- 1.5.3-2026-aug and earlier; 1.5.2-2026-aug and earlier; 1.4.2-2026-aug and earlier; 1.3.4-2026-aug and earlier; 1.3.3-2026-aug and earlier — all platforms
Magento Open Source:
- 2.4.9-2026-aug and earlier; 2.4.8-2026-aug and earlier; 2.4.7-2026-aug and earlier; 2.4.6-2026-aug and earlier — all platforms
Solution: Hotfix CVE-2026-75650 / VULN-39341 (composer patch zip and version-specific patch zips per Experience League KB; compatibility expanded in the September 11, 2026 KB update). Adobe Cloud verification example: vendor/bin/magento-patches -n status | grep "39341\|Status" — expect Applied for VULN-39341.
Out-of-support note: Adobe publishes nothing for 2.2 / 2.3 or 2.4.0–2.4.3 in this bulletin. Community backports (e.g., Scandiweb, reported by Sansec) are unverified third-party and are not treated here as an official supported fix.
Workaround and Mitigation
Immediate actions aligned to Adobe and CISA:
- Inventory every Adobe Commerce / Magento Open Source / Commerce B2B storefront (owned and vendor-operated) for versions in the Adobe affected matrix and internet exposure between September 4, 2026 and hotfix apply date.
- Apply the matching VULN-39341 / APSB26-146 hotfix package. Confirm Applied status via magento-patches where applicable.
- Follow Adobe Experience League post-patch checklist: maintenance mode; disable cron; rotate encryption keys; rotate Admin passwords; deactivate/regenerate REST/SOAP/GraphQL integration tokens; rotate OAuth secrets; rotate payment gateway credentials at the provider; rotate DB/Fastly (support ticket as needed), SSH/deploy keys, shipping/tax/extension API keys; flush cache; re-enable cron; exit maintenance; Cloud redeploy if DB credentials changed.
- Treat Adobe’s statement as binding: rotating the encryption key alone does not invalidate already-exposed credentials.
- Because CISA KEV requires forensic triage (Yes) under BOD 26-04 (due September 11, 2026 for FCEB), do not close residual risk on “hotfix applied” without compromise assessment for the pre-patch exposure window.
- Temporary WAF/Shield controls (Sansec Shield, Cloudflare, Imperva rules reported) are compensating controls—not substitutes for hotfix + credential surgery + triage.
Indicators of Compromise
Adobe APSB26-146, CISA KEV, and NVD do not publish an official IoC package (hashes, C2 domains, or IP lists) for CVE-2026-75650.
Honest empty for official IoCs: none from Adobe/CISA/NVD as of this pack date.
Sansec research describes post-compromise behaviors operators can investigate without redistributing malware samples—including Rust Linux implants masquerading under process names such as kworker/u:8:0, fc-cache, or chronyd with cron persistence; separate PHP web shells under product image cache paths; and later toolkit activity (e.g., gs-netcat, WraithC2, framework file RFI via cookie) on some stores. Treat these as research-attributed investigation leads, not an Adobe/CISA IoC list. Do not invent ATT&CK IDs or additional indicators.
References
- Adobe APSB26-146: Security update available for Adobe Commerce, 2026-09-07 — https://helpx.adobe.com/security/products/magento/apsb26-146.html
- Adobe Experience League: Commerce APSB26-146 urgent KB (hotfix + rotation; last update 2026-09-11) — https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
- CISA: Adds four known exploited vulnerabilities to catalog, 2026-09-08 — https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog
- CISA KEV catalog / JSON feed — https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- NVD: CVE-2026-75650 — https://nvd.nist.gov/vuln/detail/CVE-2026-75650
- Sansec: StyleSmuggler research — https://sansec.io/research/stylesmuggler-0day
- The Hacker News: Adobe patches Magento zero-day, 2026-09-08 — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
- Tenable: StyleSmuggler CVE-2026-75650 FAQ, 2026-09-08 — https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
Third-Party Risk Bridge: Outsourced Magento Storefronts and Payment Credentials
Adobe Commerce and Magento storefronts hold payment gateway credentials, integration tokens, and customer PII. An unauthenticated CVSS 10.0 RCE with confirmed wild exploitation means a compromised merchant or agency-run storefront is a third-party payment and data supply-chain incident for the brand—not a CMS ticket. Adobe requires hotfix VULN-39341 plus encryption-key and at-provider payment/API credential rotation; CISA’s KEV listing adds forensic triage = Yes with a September 11, 2026 federal due date. “We patched later” without rotation evidence and pre-patch triage does not close residual risk for brands that outsource storefronts.
Book a demo to see how Rescana tracks Magento/Adobe Commerce vendors for KEV-class storefront RCE, encryption-key/credential rotation evidence, and forensic-triage gaps.
Forward this advisory to your TPRM owner if agencies, SIs, or hosted-storefront vendors run Magento/Adobe Commerce for your brand—they own the VULN-39341 Applied proof, payment-credential rotation attestation, and pre-patch IR asks above.
