Full Report
Adobe also brought goodies to the patch party and they deserve immediate attention
Analysis Summary
# Vulnerability: StyleSmuggler (Adobe Commerce and Magento RCE)
## CVE Details
- **CVE ID:** CVE-2026-75650
- **CVSS Score:** 10.0 (Critical - Max Severity)
- **CWE:** Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) / PHP Injection
## Affected Systems
- **Products:** Adobe Commerce, Magento
- **Versions:** 2.4.4 up to and including 2.4.9
- **Configurations:** All online shops running these versions are vulnerable.
## Vulnerability Description
StyleSmuggler is a critical flaw that allows unauthenticated attackers to achieve Remote Code Execution (RCE). Attackers inject malicious PHP code into Magento templates by exploiting the "styles" properties, effectively bypassing built-in safety detections. Once injected, the payload typically installs a persistent backdoor.
## Exploitation
- **Status:** **Exploited in the wild (Zero-day)**. Active attacks reported since September 4.
- **Complexity:** Low (Targeted at evading safety detections automatically).
- **Attack Vector:** Network (Remote, unauthenticated).
## Impact
- **Confidentiality:** Total (Full access to store data and customer information).
- **Integrity:** Total (Ability to install backdoors and modify site code).
- **Availability:** Total (Full system compromise).
## Remediation
### Patches
- Adobe released a hotfix on Monday, September 7, 2026.
- Immediate update to the latest patched version of Adobe Commerce or Magento is required.
### Workarounds
- No specific workarounds provided; immediate patching is the only recommended course of action due to active exploitation.
## Detection
- **Indicators of Compromise:** Look for unauthorized connections to unknown command-and-control (C2) servers. Check Magento templates for suspicious "styles" property injections.
- **Detection methods and tools:** E-commerce security provider Sansec has identified active payloads installing backdoors. Security teams should scan for new, unauthorized PHP files or modifications in template directories.
## References
- Adobe Security Bulletin: [https://helpx.adobe.com/security/products/magento/apsb26-146.html](https://helpx.adobe.com/security/products/magento/apsb26-146.html)
- Sansec Research: [https://sansec.io/research/stylesmuggler-0day](https://sansec.io/research/stylesmuggler-0day)
- CISA KEV Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
***
# Vulnerability: Windows ALPC Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-85880
- **CVSS Score:** 7.8 (High)
- **CWE:** Elevation of Privilege
## Affected Systems
- **Products:** Microsoft Windows
- **Versions:** Multiple versions using Advanced Local Procedure Call (ALPC).
## Vulnerability Description
A flaw in the Windows ALPC allows a low-privilege attacker to escape a sandbox (such as an AppContainer) and elevate their privileges to **SYSTEM** level. This is a local elevation of privilege (EoP) bug.
## Exploitation
- **Status:** **Exploited in the wild.**
- **Complexity:** Low (No user interaction required).
- **Attack Vector:** Local.
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Result:** Full SYSTEM-level control of the affected machine.
## Remediation
### Patches
- Apply the Microsoft September 2026 cumulative security updates immediately.
## Detection
- Monitor for unusual ALPC traffic or low-privilege processes attempting to spawn SYSTEM-level child processes.
- **CISA Deadline:** Federal agencies must patch by September 22, 2026.
***
# Vulnerability: Microsoft Exchange Server RCE
## CVE Details
- **CVE ID:** CVE-2026-55007
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Remote Code Execution
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:** Current supported versions.
## Vulnerability Description
A remote, unauthenticated attacker can execute code by sending a malicious Visio attachment via email. The vulnerability is triggered when the Exchange server processes the attachment during content indexing.
## Exploitation
- **Status:** Not currently reported as exploited, but rated as "High Importance" by researchers.
- **Complexity:** Medium (Redmond notes it is "difficult to trigger," but requires no user interaction).
- **Attack Vector:** Network (Email-based).
## Remediation
### Patches
- Apply September 2026 Exchange Server security updates.
## References
- Microsoft Security Update Guide: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55007](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55007)