Adobe has patched CVE-2026-75650, a critical Adobe Commerce and Magento Open Source vulnerability that attackers were exploiting before a fix was available. The unauthenticated remote code execution flaw carries a CVSS score of 10.0 and is tracked by security firm Sansec as “StyleSmuggler.”
The VULN-39341 hotfix closes the vulnerability, but stores compromised before the patch can still contain persistent malware or exposed credentials. Adobe directs merchants to rotate not only Commerce encryption keys but also passwords, tokens, payment credentials, database credentials, and other secrets that attackers may have accessed.
Adobe’s APSB26-146 advisory confirms exploitation in the wild and says an attacker needs no authentication to execute arbitrary code. Defenders should not rank the flaw by its CVSS score alone because active exploitation and persistence increase the urgency beyond severity on paper.
How StyleSmuggler compromises Magento stores
Sansec says the first confirmed exploitation occurred at 22:20 UTC on Sept. 4. Sansec later reproduced the full unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations.
The exploit abuses Magento’s template system. Attackers first inject PHP code into data Magento later processes, then trigger the platform’s “Payment Transaction Failed Reminder” email so Magento executes the poisoned code.
No employee or customer needs to open the email. The malicious code runs while Magento renders the message, and the attack can succeed even if delivery fails.
A successful attack can install malware outside the web root. Sansec initially observed a Rust implant hiding behind the process name [kworker/u:8:0]. Later builds used fc-cache and then chronyd, mimicking ordinary Linux processes.
Persistence has also changed between implant variants. Some builds created cron jobs that relaunched the malware, while one chronyd variant restarted without a cron entry at all. An empty crontab therefore does not prove that a host is clean.
Disrex, which investigated compromised Magento servers directly, reported that one managed server was hit only 50 minutes after the first confirmed StyleSmuggler exploitation. The server was fully patched against previously known vulnerabilities.
During SessionReaper attacks in 2025, attackers also deployed PHP web shells to maintain access after exploiting Magento, giving defenders another reason to check for persistence after closing the initial entry point.
Who needs the Adobe hotfix
Adobe lists affected Adobe Commerce branches from 2.4.4 through 2.4.9, including their August 2026 builds and earlier releases in those branches. Adobe Commerce B2B versions from the affected 1.3.3 through 1.5.3 branches are also included.
Magento Open Source 2.4.6, 2.4.7, 2.4.8, and 2.4.9 branches are affected.
Adobe directs customers to install the VULN-39341 composer hotfix appropriate for their version. For Adobe Commerce on Cloud, Adobe also provides a Quality Patches Tool command to verify that the hotfix shows an Applied status.
The September 2026 Commerce security release does not eliminate that requirement. In APSB26-138, Adobe specifically tells customers to apply the CVE-2026-75650 hotfix in addition to the September security updates.
Adobe says the hotfix has been tested on the listed August 2026 versions. It may work on other supported configurations, but Adobe has not verified those combinations.
What defenders should hunt for after patching
Sansec has observed several implant variants since the campaign began, so defenders should not rely on a single filename or process name.
| Indicator | What to investigate |
|---|---|
[kworker/u:8:0] | A process using a kernel-thread-style name under a non-root Magento user |
fc-cache | Unexpected process or binary under ~/.cache/fontconfig/ or temporary directories |
chronyd | Unexpected chronyd process under /tmp/.chrony-* rather than the normal system path |
gvfsd-user | Binary under ~/.local/share/.gvfsd/ |
| Cron changes | Jobs launching gvfsd-user, fc-cache, or chronyd, including direct changes to cron spool files |
| UDP port 123 traffic | Unusual NTP-shaped outbound traffic from the Magento host |
PHP under pub/media | Unexpected PHP files that may indicate a secondary web shell |
Sansec says a separate attacker also used StyleSmuggler access to install a PHP web shell under the product-image cache. That payload was unrelated to the main Rust implant, so finding or removing one known malware family does not rule out additional compromise.
Sansec says eComscan can detect known StyleSmuggler background processes and terminate them for Shield customers. The company has continued improving detection as new implant variants have appeared.
Sansec has not reported evidence that the primary backdoor was used to execute attacker commands, but already-compromised hosts still require investigation.
During containment, teams should reduce unnecessary attack surface by limiting exposed services and restricting outbound connections where practical. That can make it harder for implants to reach command-and-control infrastructure while the host is being investigated.
Why Adobe requires credential rotation
Adobe warns that changing the Commerce encryption key does not invalidate secrets an attacker may already have obtained.
After applying the hotfix, Adobe’s remediation sequence includes putting the store into maintenance mode, disabling cron, and rotating:
- Commerce encryption keys and administrator passwords
- REST, SOAP, and GraphQL integration tokens
- OAuth client secrets
- Payment gateway credentials at providers such as Stripe, Braintree, Adyen, and PayPal
- Database credentials
- SSH and deployment keys
- Privileged service-account credentials
- Shipping, tax, and other third-party API keys
Adobe then directs merchants to flush caches, restore cron execution, and leave maintenance mode after the rotation work is complete.
Payment and third-party credentials should be changed at the external provider, not only inside Adobe Commerce. If an attacker already copied a valid secret, changing how Commerce encrypts its stored copy does not revoke that credential.
Stores exposed before the Sept. 7 hotfix should treat CVE-2026-75650 as an incident-response problem, not only a patching task. Apply the hotfix, verify it where Adobe provides a supported check, hunt for persistence, rotate potentially exposed credentials, and investigate suspicious activity before returning the store to normal operation.
Also read: Google patched CVE-2026-85046 after confirming exploitation in the wild, making it the sixth Chrome zero-day fixed in 2026.