---
title: "Security digest: September 7, 2026"
url: https://erroneo.us/security/2026-09-07/
description: "September 7, 2026 vulnerability digest: 1 brief (StyleSmuggler); 1 critical advisory (npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-07
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 7, 2026

1 editorial brief and 1 critical advisory.

## Take stock

- Act now: StyleSmuggler . Every merchant, agency and host running Adobe Commerce 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9, including Adobe Commerce on cloud infrastructure, plus anyone still on unsupported 2.4.3 or older.
- npm: 1 critical advisory ( @sap/cds-mtxs ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/index.md): Any self-run Magento or Adobe Commerce store without the September hotfix should be presumed compromised: patch, then scan, then rotate the encryption key and every credential it protects, and add the October fix for the follow-on BlockStrap bug.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-76969](https://erroneo.us/security/cve/CVE-2026-76969/index.md) @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) — npm @sap/cds-mtxs >= 4.0.1, < 4.0.3 → 4.0.3; npm @sap/cds-mtxs >= 3.0.1, < 3.9.7 → 3.9.7; npm @sap/cds-mtxs >= 2.0.2, < 2.7.7 → 2.7.7

---
Source page: https://erroneo.us/security/2026-09-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt