Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE

What to do

1. Check whether the hotfix is present: vendor/bin/magento-patches -n status | grep "39341\|Status"
2. Apply the VULN-39341 hotfix for your patch level, then the October 2026 release or isolated patch for CVE-2026-103849; keep both.
3. Scan the store for StyleSmuggler implants, web shells and skimmers before declaring it clean; the hotfix does not remove them.
4. Rotate the Magento encryption key and every credential it protected (admin, integration and OAuth tokens, payment gateway keys, database, SSH and deploy keys) at the source.
5. Put WAF protection in front of the store as defense in depth, and plan an upgrade off any 2.4.3-or-older install, which has no Adobe fix.

How to check if you are affected or compromised

• Run grep -ril 'x_trace_' var/report/ and find -L pub/media -type f -name '*.php' from the Magento root.
• Look for web-user processes named [kworker/u:8:0], fc-cache or chronyd, and for cron entries pointing at ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/.
• Search var/log/exception.log with grep -aF for Laminas\Loader\Exception\InvalidArgumentException.
• Check core_config_data at design/head/includes for injected script loaders, and egress logs for UDP/123 to non-standard NTP hosts.

What happened#

On September 7, 2026, Adobe published APSB26-146, a priority 1 hotfix for CVE-2026-75650. The flaw is a template-engine injection (CWE-1336) in Adobe Commerce and Magento Open Source. Adobe scores it CVSS 3.1 10.0, says no authentication is required, and states that it "is aware of CVE-2026-75650 being exploited in the wild."

Sansec, which named the bug StyleSmuggler, had gone public two days earlier. It saw unsuccessful probes on August 23 and the first confirmed compromise at 22:20 UTC on September 4. The attack has two stages. First, the attacker plants PHP in a file Magento writes itself. One variant puts the code in a request to /paypal/transparent/response/, which Magento logs under var/report/. Second, a POST /graphql request abuses a styles parameter so the template engine includes that file while rendering the "Payment Transaction Failed Reminder" email. Neither stage needs a login, an admin session or a form key.

CISA added the CVE to its KEV catalog on September 8. On October 13, APSB26-153 fixed CVE-2026-103849, another unauthenticated template-engine injection scored 10.0. Sansec calls it BlockStrap and says it "exposes a gap left by the StyleSmuggler fix." Adobe reports no known exploitation and rated the update priority 2. Sansec disputes that rating, per BleepingComputer.

Who is affected#

Adobe lists these builds as affected, in each case the "2026-aug" release and earlier:

• Adobe Commerce 2.4.4 through 2.4.9
• Commerce B2B 1.3.3 through 1.5.3
• Magento Open Source 2.4.6 through 2.4.9

The fix is a patch file, VULN-39341, not a new version number. Adobe's knowledge-base notice maps patch files to each patch level, and cloud merchants apply it too. Sansec reports that a store on 2.4.6-p15, with the July and August patches installed, was still hit. Adobe offers no patch for 2.2, 2.3 or 2.4.0 through 2.4.3. A community backport exists for those, but Sansec has not reviewed it.

Do you really need to act?#

Yes, if you run Magento or Adobe Commerce yourself or through an agency. This is a pre-authentication RCE against the checkout stack, and attackers used it for days before any patch existed. Sansec watched the payloads change several times a day.

Attackers dropped a Rust Linux backdoor that disguises its command traffic as NTP packets. The Hacker News also reports PHP droppers that install web shells, and Sansec found payment skimmers.

Patching is necessary but not enough. Adobe and Sansec both say the hotfix does not clean a store that was already compromised. Rotating the encryption key alone also does not invalidate secrets an attacker has already read. Shopify and BigCommerce merchants are unaffected.

What to do now#

1. Check: vendor/bin/magento-patches -n status | grep "39341\|Status"
2. Apply the VULN-39341 patch for your version (VULN-39341-composer-patches.zip from repo.magento.com, or the per-version file Adobe lists). Then install the 2026-oct release or Adobe's isolated BlockStrap patch. Keep both fixes in place.
3. Scan for compromise (next section) before you call the store clean.
4. Follow Adobe's procedure: enable maintenance mode, stop cron, then rotate the encryption key. Next, rotate admin passwords, integration and OAuth tokens, payment gateway keys, database credentials, SSH and deploy keys, and extension API keys, each at its source.
5. Keep WAF rules on as an extra layer, not a fix. Sansec notes that Cloudflare and Imperva shipped rules on September 10 and that Commerce Cloud has a Fastly virtual patch. Move any install on 2.4.3 or older to a supported release.

How to tell if you were hit#

From the Magento root, run Sansec's checks: grep -ril 'x_trace_' var/report/ and find -L pub/media -type f -name '*.php'. Run ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd' and look for web-user processes such as [kworker/u:8:0]. Inspect the cron spool directly for entries pointing at ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/. One implant build relaunches without cron, so an empty crontab proves nothing. Search var/log/exception.log with grep -aF for Laminas\Loader\Exception\InvalidArgumentException, and check core_config_data at design/head/includes for injected loaders. On the network, UDP/123 traffic to hosts such as ntp.timesync.to is a strong signal.

Timeline#

• Aug 23, 2026 — Sansec sees unsuccessful probes.
• Sep 4, 2026 — The first confirmed compromise occurs at 22:20 UTC.
• Sep 5, 2026 — Sansec publishes StyleSmuggler while the bug is still unpatched.
• Sep 7, 2026 — Adobe releases APSB26-146 and the VULN-39341 hotfix.
• Sep 8, 2026 — CISA adds CVE-2026-75650 to KEV, with a September 11 deadline.
• Oct 13, 2026 — Adobe releases APSB26-153, fixing BlockStrap (CVE-2026-103849).
• Oct 16, 2026 — Sansec reports no BlockStrap attacks yet and urges merchants to keep both fixes in place.

Vulnerability records

• CVE-2026-75650 · KEV 2026-09-08 · Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code…
• CVE-2026-103849 · Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB26-146: Security update available for Adobe Commerce adobe.com
2. Adobe Experience League — Critical security update available for Adobe Commerce (APSB26-146) experienceleague.adobe.com
3. Adobe — APSB26-153: Security update available for Adobe Commerce adobe.com
4. CVE record — CVE-2026-75650 cve.org
5. NVD — CVE-2026-75650 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-75650 cisa.gov
7. Sansec — StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack sansec.io

Coverage and analysis

1. The Hacker News — Adobe patches Magento zero-day thehackernews.com
2. BleepingComputer — Critical BlockStrap flaw lets hackers run code on Magento servers bleepingcomputer.com