Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine…

CVE-2026-75650, dubbed StyleSmuggler by Sansec, is an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source's template engine (CWE-1336). The attack is a two-stage chain: first, the attacker poisons a PHP file that Magento itself writes — such as a failure report or system log — by injecting template directives through styles properties that bypass existing sanitization. Second, the attacker triggers rendering of that poisoned file (e.g., via a failed-payment email path), achieving arbitrary PHP execution as the web-server user. Every release from 2.4.4 through 2.4.9 is affected, including fully patched August 2026 builds like 2.4.6-p15. The hotfix VULN-39341 was released September 7; exploitation began September 4.

Adobe's CVSS 10.0 / Priority 1 rating is accurate and, unusually, may even *understate* the operational severity. The vector is AV:N/AC:L/PR:N/UI:N/S:C — network-reachable, no auth, no user interaction, scope change — and real-world exploitation confirms this is trivially weaponizable. Post-exploitation payloads include a Rust-based persistent backdoor that masquerades as kernel workers ([kworker/u:8:0]), fc-cache, or chronyd, exfiltrating data via disguised NTP traffic on UDP/123. A separate campaign is deploying PHP webshells and payment skimmers. Given that Magento stores process credit-card data and PII under PCI DSS scope, this is a textbook 10.0.

Why this verdict

• Zero authentication barrier: CVSS vector confirms PR:N/UI:N — any internet host can exploit any Magento storefront. No credentials, sessions, or user interaction required. This is the widest possible attack surface.
• Active exploitation predating patch: Attacks began Sept 4, the advisory dropped Sept 5, the hotfix arrived Sept 7. Every unpatched store was a sitting target for 3+ days with no vendor mitigation available. Multiple independent threat actors are confirmed.
• Role multiplier: Adobe Commerce / Magento is *canonically* an internet-facing production application that processes payment card data under PCI DSS. The blast radius of compromise is not limited to the server — it extends to every customer's financial data, enabling mass payment skimming, PII exfiltration, and brand destruction. ~50k–111k instances are exposed globally; 100% of installs occupy this high-value role by definition. The floor is CRITICAL.
• Persistent post-exploitation tooling: Observed payloads include a compiled Rust backdoor using NTP-disguised C2 and PHP webshells — this is not smash-and-grab but sustained access designed to survive patching without full incident response.
• Scope: Changed: The CVSS S:C flag is earned — the attacker pivots from the web application to the underlying OS, database tier, and downstream payment processors via harvested credentials.

Why not higher?

CVSS 10.0 is the maximum possible score. The vendor rating is already at ceiling. There is no higher bucket than CRITICAL.

Why not lower?

Every friction-audit criterion argues against downgrade: the attacker position is unauthenticated remote, the prerequisite chain has zero compounding narrowing factors, the exposed population is 100% of installs (internet-facing by design), and no standard security control (EDR, WAF, MFA, NGFW) stopped the initial wave. Active exploitation with persistent backdoors and PCI-scoped data at risk categorically prevents any reduction below CRITICAL.

1. Apply hotfix VULN-39341 immediately — Download VULN-39341-composer-patches.zip from repo.magento.com and apply via composer. This is the definitive fix. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days (by Sept 10). Given active exploitation, deploy within hours.
2. Block PHP execution in media/static directories at the web-server layer — Add Nginx/Apache rules denying .php execution in pub/media/, pub/static/, and var/report/. This breaks the webshell persistence path. Example for Nginx: location ~* ^/(pub/media|pub/static|var)/.+\.php$ { deny all; }
3. Deploy WAF rules blocking template-injection markers in style attributes — Configure your WAF (Cloudflare, Akamai, AWS WAF, Fastly) to block requests containing Magento template directives ({{, }}, block type=, template=) inside CSS style attribute values. Sansec Shield has shipped signatures since Sept 5.
4. Restrict outbound UDP/123 from web tier to sanctioned NTP servers only — The Rust backdoor uses UDP/123 disguised as NTP for C2. Restrict egress so only your corporate NTP servers are reachable on this port from the web tier. This disrupts the observed C2 channel.
5. Conduct full compromise assessment on unpatched instances — If your store was unpatched between Sept 4–7, assume compromise. Audit admin_user table for unauthorized entries, scan pub/media/ and var/report/ for unexpected PHP files, check for unknown processes masquerading as kworker, fc-cache, or chronyd, and rotate all credentials: admin passwords, API tokens, OAuth secrets, payment gateway keys, database credentials, SSH keys, and encryption keys. Do this at the credential *source*, not just within Magento.
6. Enable file-integrity monitoring on web-root and config directories — Deploy FIM (OSSEC, Wazuh, Tripwire, or cloud-native equivalent) on pub/, var/, app/etc/, and vendor/ to detect unauthorized file changes — both for this CVE and future Magento attacks.

Run this script on each Magento application server as a user with read access to the Magento installation directory. Invoke with: bash check_cve_2026_75650.sh /var/www/magento (replace with your Magento root path). No root privileges required — just read access to the composer and patches directories.

#!/usr/bin/env bash
# check_cve_2026_75650.sh — Detect CVE-2026-75650 (StyleSmuggler) patch status
# Usage: bash check_cve_2026_75650.sh /path/to/magento
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

MAGE_ROOT="${1:-}"
if [[ -z "$MAGE_ROOT" || ! -d "$MAGE_ROOT" ]]; then
  echo "Usage: $0 /path/to/magento-root"
  exit 2
fi

# Method 1: Check via magento-patches CLI (preferred)
if [[ -x "$MAGE_ROOT/vendor/bin/magento-patches" ]]; then
  PATCH_STATUS=$("$MAGE_ROOT/vendor/bin/magento-patches" -n status 2>/dev/null || true)
  if echo "$PATCH_STATUS" | grep -qi '39341.*applied\|VULN-39341.*Applied'; then
    echo "PATCHED — VULN-39341 hotfix is applied (confirmed via magento-patches)."
    exit 0
  elif echo "$PATCH_STATUS" | grep -qi '39341'; then
    echo "VULNERABLE — VULN-39341 hotfix is present but NOT applied."
    exit 1
  fi
fi

# Method 2: Check composer.json / composer.lock for the patch reference
if grep -rq 'VULN-39341\|vuln-39341' "$MAGE_ROOT/composer.json" "$MAGE_ROOT/composer.lock" 2>/dev/null; then
  echo "PATCHED — VULN-39341 reference found in composer configuration."
  exit 0
fi

# Method 3: Check if the Magento version is in the affected range
VERSION_FILE="$MAGE_ROOT/vendor/magento/framework/AppInterface.php"
COMPOSER_LOCK="$MAGE_ROOT/composer.lock"
VERSION=""

if [[ -f "$VERSION_FILE" ]]; then
  VERSION=$(grep -oP "VERSION\s*=\s*'\K[^']+" "$VERSION_FILE" 2>/dev/null || true)
elif [[ -f "$COMPOSER_LOCK" ]]; then
  VERSION=$(grep -A2 '"magento/product-community-edition"\|"magento/product-enterprise-edition"' "$COMPOSER_LOCK" \
    | grep -oP '"version":\s*"\K[^"]+' | head -1 || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine Magento version. Manually verify VULN-39341 hotfix status."
  exit 2
fi

echo "Detected Magento version: $VERSION"

# All 2.4.4 through 2.4.9 are vulnerable without the hotfix
if echo "$VERSION" | grep -qP '^2\.4\.[4-9]'; then
  echo "VULNERABLE — Version $VERSION is in the affected range (2.4.4–2.4.9) and VULN-39341 hotfix was NOT detected."
  exit 1
else
  echo "UNKNOWN — Version $VERSION may not be in the known affected range. Verify with Adobe advisory APSB26-146."
  exit 2
fi

Sources

1. Sansec — StyleSmuggler 0-day Research
2. Adobe Security Bulletin APSB26-146
3. The Hacker News — Magento Zero-Day Coverage
4. SOCRadar — StyleSmuggler Analysis
5. CCB Belgium — Active Exploitation Advisory
6. SecurityArsenal — Detection and Mitigation Guide
7. CyberSecurityNews — Adobe Commerce Vulnerabilities
8. MageDispatch — APSB26-146 Hotfix Details