Dateline: September 8, 2026
Attackers were inside Magento stores three days before there was a patch to install. That is the timeline that matters here.
On Monday, Adobe shipped an emergency fix for a maximum severity flaw in Adobe Commerce and Magento Open Source. A Dutch e-commerce security firm had already caught it being exploited in the wild, starting September 4. The flaw is tracked as CVE-2026-75650 and carries a CVSS score of 10.0, the highest the scale goes. Adobe confirmed the bug is being used against live merchants.
What Happened?
The exploit abuses the part of Magento that builds emails. Researchers named it StyleSmuggler because it smuggles PHP code into the template system by hiding inside style properties, which slips past existing checks.
It runs in two stages. First the attacker plants malicious code by triggering a failure report. Then Magento runs that code when it sends a specific message, the “Payment Transaction Failed Reminder” email. No login is needed and no user has to click anything. That combination, unauthenticated plus remote code execution on the store server, is about as bad as web flaws get.
Every current release line is affected, from 2.4.4 through 2.4.9, including B2B builds. One detail should worry anyone who patches on schedule: the first confirmed victim was running 2.4.6 with both the July and August 2026 updates applied. Fully patched, and still hit.
What’s the Impact?
A successful attack hands the attacker code execution and a quiet way back in.
Investigators saw a backdoor written in Rust that beacons to a command server and waits for orders. It disguises itself as a normal Linux process, first as a kernel worker thread, then in a later version as a font cache helper. It hides its traffic by dressing it up to look like time-server replies, and it reports back host details like hostname, disk and memory use, OS version, and whether it has root. A separate strand of the attack dropped a PHP web shell that can run any PHP the attacker sends.
For a store, that means full server control, the theft of customer and payment data, and the classic risk of a payment skimmer quietly sitting on the checkout page. One managed Magento server was compromised about 50 minutes after the first exploitation was confirmed. This moved fast.
Full indicators of compromise are listed in the separate IOC reference below.
StyleSmuggler / CVE-2026-75650
Published indicators for the Magento and Adobe Commerce zero-day. Source: Sansec Forensics research and Adobe advisory APSB26-146. Values current as of September 7, 2026 and still being updated by the researchers.
Vulnerability
Maximum severity remote code execution in Adobe Commerce and Magento Open Source. CVSS 10.0. Exploited in the wild from September 4, 2026.
Network Command and control
The Rust backdoor beacons out and disguises its traffic to look like NTP time-server replies. Block and hunt for this domain in outbound logs.
Process Backdoor disguises
The Rust implant hides among normal Linux processes. Names rotated across variants. Investigate any of these that do not match a known legitimate process.
Behavior Trigger and payload
Code executes through a specific Magento email. Watch for unusual bursts of these, and for a PHP dropper that writes a web shell. Legitimate declined payments can also produce this email, so treat it as a signal to investigate, not proof.
Affected Versions
Adobe Commerce, Commerce B2B, and Magento Open Source. Every release line from 2.4.4 through 2.4.9. The first confirmed victim was fully patched to the August 2026 level.
Response order: apply VULN-39341, then rotate encryption keys starting with the encryption key, then scan for the implant and any secondary web shells. Patching closes the hole but does not clean a store that was already hit. Note: indicators were still being updated by the researchers at time of writing. Confirm against the vendor source before acting on any single value.
How to Avoid This
Apply Adobe’s VULN-39341 hotfix for CVE-2026-75650 now, matched to your version. Adobe is clear that patching is not enough on its own. You also have to rotate your encryption keys, because the flaw may have exposed them, and start with the encryption key before other credentials.
Then assume the patch is the start of the job, not the end. Stores were being hit for three days before a fix existed, so a clean patch does not mean a clean store. Scan the file system and running processes for the backdoor and any secondary web shells before you call it closed. Watch for unexpected bursts of “Payment Transaction Failed Reminder” emails, though real declined payments can trigger the same message, so treat it as a signal to look, not proof on its own. Review web and application logs for odd unauthenticated requests around September 4 and after.
