Adobe has taken swift action by issuing security updates to mitigate a severe flaw in Adobe Commerce and Magento Open Source. This vulnerability, identified as CVE-2026-75650, was actively exploited in the wild, prompting an urgent response from Adobe to protect its users.
Details of the Critical Vulnerability
The flaw, referred to as StyleSmuggler, was discovered by Sansec on September 4, 2026. With a CVSS score of 10.0, this vulnerability allows for arbitrary code execution, posing significant risks to Adobe Commerce merchants.
The issue stems from the misuse of Magento’s template system, where PHP code injection enables unauthorized execution via a “Payment Transaction Failed Reminder” email. This flaw affects multiple versions of Adobe Commerce and Magento Open Source, requiring immediate action from users.
Versions Impacted and Available Patches
The vulnerability affects Adobe Commerce versions 2.4.9-2026-aug and earlier, and Adobe Commerce B2B versions 1.5.3-2026-aug and earlier, along with several others. Magento Open Source versions up to 2.4.6-2026-aug are also impacted.
Adobe has released a hotfix, available for download, to address this critical issue. Users are advised to apply the VULN-39341 patch and rotate encryption keys to secure their systems against potential exploits.
Exploitation and Security Implications
Following the vulnerability’s disclosure, security experts observed malicious actors employing CVE-2026-75650 to install a Rust-based Linux backdoor. This backdoor communicates with an external server, receiving commands for further exploitation.
Additionally, attackers have used the flaw to deploy a PHP dropper on vulnerable sites, enabling the execution of arbitrary PHP code through a web shell. These developments highlight the importance of applying the patch immediately to safeguard e-commerce platforms.
Reports from Netherlands-based Disrex indicate that a Magento server was compromised shortly after the first known StyleSmuggler exploitation. The rapid breach underscores the necessity for timely updates and rigorous security practices.
In conclusion, Adobe’s prompt release of security patches serves as a crucial measure to protect users from ongoing threats. Merchants and developers are urged to implement the updates to secure their systems and prevent unauthorized access.
