Full Report
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. [...]
Analysis Summary
# Vulnerability: StyleSmuggler Zero-Day Arbitrary Code Execution
## CVE Details
- **CVE ID:** CVE-2026-75650
- **CVSS Score:** 10.0 (Critical / Max-Severity)
- **CWE:** Not explicitly stated (Arbitrary Code Execution / Improper Input Validation)
## Affected Systems
- **Products:** Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
- **Versions:**
- Adobe Commerce: 2.4.4 through 2.4.9 (including August 2026 releases and earlier).
- Adobe Commerce B2B: 1.3.3 through 1.5.3 (including August 2026 releases and earlier).
- Magento Open Source: 2.4.6 through 2.4.9 (including August 2026 releases and earlier).
- **Configurations:** Vulnerable in standard installations; compatibility for the hotfix is confirmed for August 2026 releases.
## Vulnerability Description
Dubbed "StyleSmuggler," this zero-day vulnerability allows for arbitrary code execution (ACE). While technical specifics of the "Smuggling" mechanism are not fully detailed in the report, the flaw is critical enough to allow attackers to plant persistent backdoors on the underlying Linux servers and deploy web shells.
## Exploitation
- **Status:** **Exploited in the Wild** (Actively leveraged since at least September 4, 2026).
- **Complexity:** Low (Based on mass exploitation reports).
- **Attack Vector:** Network (Remote).
- **PoC Available:** No public standalone PoC provided, but multiple attack groups are using distinct tooling/web shells.
## Impact
- **Confidentiality:** Critical (Data exfiltration observed).
- **Integrity:** Critical (Unauthorized file modification and backdoor installation).
- **Availability:** Critical (Total system compromise and control).
## Remediation
### Patches
- **Hotfix VULN-39341:** Adobe recommends immediate installation of this emergency hotfix. Note that it was primarily tested against August 2026 releases.
### Workarounds
- Adobe has not provided a configuration-based workaround that replaces the need for the hotfix. Immediate patching is the primary mitigation.
## Detection
- **Indicators of Compromise (IoCs):**
- Unexpected "Payment Transaction Failed Reminder" emails.
- Outbound Network Time Protocol (NTP) traffic directed toward suspicious or unauthorized hosts (C2 disguised as NTP).
- Presence of a 485-byte PHP web shell in the file system.
- Requests directed toward `oast.site` subdomains (associated with Interactsh tool usage).
- **Detection Methods:**
- Monitor `pub/media` directories for unauthorized write activity.
- Audit GraphQL integration tokens and administrator account activity.
## Post-Exploitation Actions (Mandatory)
If a compromise is suspected or as a precaution after patching:
1. Enable maintenance mode and suspend cron jobs.
2. **Rotate all secrets:** Administrator passwords, GraphQL tokens, OAuth client secrets, payment gateway credentials, database credentials, SSH keys, and API keys.
3. Flush the cache and restore services.
## References
- Adobe Security Advisory: [http[://]helpx.adobe.com/security/products/magento/apsb26-146.html]
- Adobe Knowledge Base: [https[://]experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146]
- Sansec Research: [http[://]sansec.io/research/stylesmuggler-0day]