Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.
The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.
"This update resolves a critical vulnerability that could result in arbitrary code execution," Adobe said, adding it's "aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants."
At its core, the flaw abuses Magento's template system through PHP code injection to generate a "Payment Transaction Failed Reminder" email, triggering code execution in the process.
The shortcoming affects the following versions -
-
Adobe Commerce
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
- 2.4.5-2026-aug and earlier
- 2.4.4-2026-aug and earlier
-
Adobe Commerce B2B
- 1.5.3-2026-aug and earlier
- 1.5.2-2026-aug and earlier
- 1.4.2-2026-aug and earlier
- 1.3.4-2026-aug and earlier
- 1.3.3-2026-aug and earlier
-
Magento Open Source
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
Patches have been released as part of a hotfix's available for download from the following link: repo.magento[.]com/patch/VULN-39341-composer-patches.zip
"To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys," Adobe said.
The development comes days after the Dutch e-commerce security company revealed that threat actors are exploiting CVE-2026-75650 to deploy a Rust-based Linux backdoor that connects to an external server and awaits further instructions. Separately, the issue has been abused to deliver a PHP dropper on susceptible sites that writes a web shell capable of executing arbitrary PHP code.
According to Netherlands-based Disrex, a Magento server managed by the e-commerce development platform is said to have been compromised 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026, at 10:20 p.m. UTC.
"StyleSmuggler turns Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain," Disrex said.
Telemetry data from Previdian shows that 12 exploitation attempts have been recorded against its honeypots since September 7, 2026, from two unique IP addresses from China and Romania. That said, the efforts have been unsuccessful, Founder and CEO Ryan Dewhurst said.
