Vulnerabilities · 50 days ago
Adobe says CVE-2026-75650 is still being actively exploited in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, and it has issued Hotfix VULN-39341 for the StyleSmuggler flaw. CSIRT Italia and the Dutch NCSC also said the issue is already being used in the wild, with attackers reaching unpatched stores through the platform’s template-rendering path.
The flaw lets crafted input get treated as code when Magento builds a normal transactional email, so the attacker’s PHP runs as part of the site instead of as plain text. Sansec, Tenable, and other reporting say that is being used to plant persistent backdoors and web shells, which is why Adobe and incident responders are also urging rotation of encryption keys and credentials protected by those keys.
For operators, the exposure does not end at the patch if the store was already touched. If Commerce or Magento sits on customer data, admin access, or secrets that the application can decrypt, the incident can leave behind both code-level persistence and readable credentials that survive a simple version update.
Known exploited · CISA KEV
CVSS 10 CRITICAL: adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. EPSS 4% (90th percentile).
CISA federal remediation date Sep 11
6 sources covering this story
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day
Tracked as CVE-2026-75650, the exploited defect allows unauthenticated attackers to execute arbitrary code.
CVE-2026-75650: StyleSmuggler Adobe Commerce FAQ | Tenable®
CVE-2026-75650, StyleSmuggler, is a critical zero-day remote code execution vulnerability in Adobe Commerce actively exploited since September 4.
Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce.
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe patches actively exploited CVE-2026-75650 in Commerce and Magento, used to deploy Linux backdoors and PHP web shells.
Adobe: rilevato sfruttamento in rete della CVE-2026-75650
Aggiornamenti di sicurezza Adobe sanano una vulnerabilità con gravità “critica” in Adobe Commerce, Adobe Commerce B2B e Magento Open Source, piattaforme per il commercio elettronico utilizzate per la realizzazione e la gestione di siti e servizi di vendita online.
Kwetsbaarheid verholpen in Adobe Commerce en Magento
Adobe heeft een kwetsbaarheid verholpen in Adobe Commerce en Magento.
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
A zero-day vulnerability dubbed
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores.
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec says attackers exploit an unpatched Magento and Adobe Commerce flaw to run server code without authentication and install persistent backdoors.
Part of the PlainSec briefing for 2026-09-07