---
title: "Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE"
url: https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/
description: "Unauthenticated RCE in Adobe Commerce and Magento Open Source, exploited since Sep 4. Apply hotfix VULN-39341 plus the Oct 2026 update, rotate keys, scan."
type: security-brief
section: "Security Digest"
date_published: 2026-09-07
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-75650", "CVE-2026-103849"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE

**Verdict: Act now.** Any self-run Magento or Adobe Commerce store without the September hotfix should be presumed compromised: patch, then scan, then rotate the encryption key and every credential it protects, and add the October fix for the follow-on BlockStrap bug.

- **Who must act:** Every merchant, agency and host running Adobe Commerce 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9, including Adobe Commerce on cloud infrastructure, plus anyone still on unsupported 2.4.3 or older.
- **Who can relax:** Stores on hosted SaaS platforms such as Shopify or BigCommerce, and teams with no Magento code anywhere in production.
- **Affected:** Adobe Commerce 2.4.4 through 2.4.9, 2026-aug builds and earlier; Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3, 2026-aug builds and earlier; Magento Open Source 2.4.6 through 2.4.9, 2026-aug builds and earlier; Older branches (2.2, 2.3, 2.4.0-2.4.3): affected per Sansec, no Adobe patch
- **Fixed:** Hotfix VULN-39341 for CVE-2026-75650 (APSB26-146, Sep 7, 2026); 2026-oct releases or Adobe's isolated patch for CVE-2026-103849 (APSB26-153, Oct 13, 2026), applied in addition to VULN-39341
- **CVEs:** CVE-2026-75650, CVE-2026-103849
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check whether the hotfix is present: vendor/bin/magento-patches -n status | grep "39341\|Status"
2. Apply the VULN-39341 hotfix for your patch level, then the October 2026 release or isolated patch for CVE-2026-103849; keep both.
3. Scan the store for StyleSmuggler implants, web shells and skimmers before declaring it clean; the hotfix does not remove them.
4. Rotate the Magento encryption key and every credential it protected (admin, integration and OAuth tokens, payment gateway keys, database, SSH and deploy keys) at the source.
5. Put WAF protection in front of the store as defense in depth, and plan an upgrade off any 2.4.3-or-older install, which has no Adobe fix.

### How to check if you are affected

- Run grep -ril 'x_trace_' var/report/ and find -L pub/media -type f -name '*.php' from the Magento root.
- Look for web-user processes named [kworker/u:8:0], fc-cache or chronyd, and for cron entries pointing at ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/.
- Search var/log/exception.log with grep -aF for Laminas\Loader\Exception\InvalidArgumentException.
- Check core_config_data at design/head/includes for injected script loaders, and egress logs for UDP/123 to non-standard NTP hosts.

## What happened

On September 7, 2026, Adobe published [APSB26-146](https://www.adobe.com/trust/security/products/commerce/apsb26-146), a priority 1 hotfix for CVE-2026-75650. The flaw is a template-engine injection (CWE-1336) in Adobe Commerce and Magento Open Source. Adobe scores it CVSS 3.1 10.0, says no authentication is required, and states that it "is aware of CVE-2026-75650 being exploited in the wild."

[Sansec](https://sansec.io/research/stylesmuggler), which named the bug StyleSmuggler, had gone public two days earlier. It saw unsuccessful probes on August 23 and the first confirmed compromise at 22:20 UTC on September 4. The attack has two stages. First, the attacker plants PHP in a file Magento writes itself. One variant puts the code in a request to `/paypal/transparent/response/`, which Magento logs under `var/report/`. Second, a `POST /graphql` request abuses a `styles` parameter so the template engine includes that file while rendering the "Payment Transaction Failed Reminder" email. Neither stage needs a login, an admin session or a form key.

CISA added the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650) on September 8. On October 13, [APSB26-153](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) fixed CVE-2026-103849, another unauthenticated template-engine injection scored 10.0. Sansec calls it BlockStrap and says it "exposes a gap left by the StyleSmuggler fix." Adobe reports no known exploitation and rated the update priority 2. Sansec disputes that rating, per [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/).

## Who is affected

Adobe lists these builds as affected, in each case the "2026-aug" release and earlier:

- Adobe Commerce 2.4.4 through 2.4.9
- Commerce B2B 1.3.3 through 1.5.3
- Magento Open Source 2.4.6 through 2.4.9

The fix is a patch file, VULN-39341, not a new version number. Adobe's [knowledge-base notice](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146) maps patch files to each patch level, and cloud merchants apply it too. Sansec reports that a store on 2.4.6-p15, with the July and August patches installed, was still hit. Adobe offers no patch for 2.2, 2.3 or 2.4.0 through 2.4.3. A community backport exists for those, but Sansec has not reviewed it.

## Do you really need to act?

Yes, if you run Magento or Adobe Commerce yourself or through an agency. This is a pre-authentication RCE against the checkout stack, and attackers used it for days before any patch existed. Sansec watched the payloads change several times a day.

Attackers dropped a Rust Linux backdoor that disguises its command traffic as NTP packets. [The Hacker News](https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html) also reports PHP droppers that install web shells, and Sansec found payment skimmers.

Patching is necessary but not enough. Adobe and Sansec both say the hotfix does not clean a store that was already compromised. Rotating the encryption key alone also does not invalidate secrets an attacker has already read. Shopify and BigCommerce merchants are unaffected.

## What to do now

1. Check: `vendor/bin/magento-patches -n status | grep "39341\|Status"`
2. Apply the VULN-39341 patch for your version (`VULN-39341-composer-patches.zip` from `repo.magento.com`, or the per-version file Adobe lists). Then install the 2026-oct release or Adobe's isolated BlockStrap patch. Keep both fixes in place.
3. Scan for compromise (next section) before you call the store clean.
4. Follow Adobe's procedure: enable maintenance mode, stop cron, then rotate the encryption key. Next, rotate admin passwords, integration and OAuth tokens, payment gateway keys, database credentials, SSH and deploy keys, and extension API keys, each at its source.
5. Keep WAF rules on as an extra layer, not a fix. Sansec notes that Cloudflare and Imperva shipped rules on September 10 and that Commerce Cloud has a Fastly virtual patch. Move any install on 2.4.3 or older to a supported release.

## How to tell if you were hit

From the Magento root, run Sansec's checks: `grep -ril 'x_trace_' var/report/` and `find -L pub/media -type f -name '*.php'`. Run `ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd'` and look for web-user processes such as `[kworker/u:8:0]`. Inspect the cron spool directly for entries pointing at `~/.local/share/.gvfsd/` or `~/.cache/fontconfig/`. One implant build relaunches without cron, so an empty crontab proves nothing. Search `var/log/exception.log` with `grep -aF` for `Laminas\Loader\Exception\InvalidArgumentException`, and check `core_config_data` at `design/head/includes` for injected loaders. On the network, UDP/123 traffic to hosts such as `ntp.timesync.to` is a strong signal.

## Timeline

- Aug 23, 2026 — Sansec sees unsuccessful probes.
- Sep 4, 2026 — The first confirmed compromise occurs at 22:20 UTC.
- Sep 5, 2026 — Sansec publishes StyleSmuggler while the bug is still unpatched.
- Sep 7, 2026 — Adobe releases APSB26-146 and the VULN-39341 hotfix.
- Sep 8, 2026 — CISA adds CVE-2026-75650 to KEV, with a September 11 deadline.
- Oct 13, 2026 — Adobe releases APSB26-153, fixing BlockStrap (CVE-2026-103849).
- Oct 16, 2026 — Sansec reports no BlockStrap attacks yet and urges merchants to keep both fixes in place.

## Sources

1. [Adobe — APSB26-146: Security update available for Adobe Commerce](https://www.adobe.com/trust/security/products/commerce/apsb26-146)
2. [Adobe Experience League — Critical security update available for Adobe Commerce (APSB26-146)](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146)
3. [Adobe — APSB26-153: Security update available for Adobe Commerce](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html)
4. [CVE record — CVE-2026-75650](https://www.cve.org/CVERecord?id=CVE-2026-75650)
5. [NVD — CVE-2026-75650](https://nvd.nist.gov/vuln/detail/CVE-2026-75650)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-75650](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650)
7. [Sansec — StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack](https://sansec.io/research/stylesmuggler)
8. [The Hacker News — Adobe patches Magento zero-day](https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html)
9. [BleepingComputer — Critical BlockStrap flaw lets hackers run code on Magento servers](https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/)

---
Source page: https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt