CVE-2026-75650

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-75650 10.0

Adobe · Commerce and Magento · Added 2026-09-08 · Published 2026-09-07

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

VendorAdobe

ProductCommerce and Magento

Date added2026-09-08

Due date2026-09-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-1336

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

NVD: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-08 19:41 UTC

Searches4

Component defaultyes

Sources https://helpx.adobe.com/security/products/magento/apsb26-146.html
https://sansec.io/research/stylesmuggler-0day
https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/
https://securityarsenal.com/blog/cve-2026-75650-adobe-commerce-magento-stylesmuggler-zero-day-exploited-in-the-wild-detection-and-remediation-guide
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650

Hunting hypothesis agent

Hunt for failed-payment email bursts from Magento stores without gateway decline -- the attacker triggers Payment Transaction Failed Reminder to execute injected PHP, then look for [kworker/u:8:0], fc-cache, or chronyd processes in /tmp.

Research details

ComponentMagento template engine styles properties — attacker-injected PHP in style property values is persisted to disk and executed when Magento renders transactional email templates (Payment Transaction Failed Reminder)

PreconditionsTarget must run Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, or Magento Open Source 2.4.6 through 2.4.9. No authentication is required; the attacker needs only network reachability to the Magento storefront (HTTP/HTTPS). The attack vector is unauthenticated and requires no user interaction — exploitation occurs when Magento processes the injected styles properties and subsequently renders the poisoned transactional email template. agent

Public PoCno

Advisoryhttps://helpx.adobe.com/security/products/magento/apsb26-146.html

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). StyleSmuggler exploitation chain is fully unauthenticated. Tenable confirmed no standalone public PoC as of September 8, 2026. The attack was actively exploited starting September 4, 2026, three days before the vendor patch was available. Two distinct threat actors have been observed on the same victims using different tooling: one deploying a persistent Rust-based implant (variants: [kworker/u:8:0], fc-cache, chronyd) and a second dropping PHP web shells into pub/media/product/cache/.

SummaryCVE-2026-75650 (StyleSmuggler) is a critical CVSS 10.0 unauthenticated remote code execution vulnerability in Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, and Magento Open Source 2.4.6–2.4.9. The flaw exists in how Magento's template engine processes style-related properties — an attacker injects PHP code via the styles properties within the template system, which Magento writes to disk as part of normal operations. The injected code is executed when the platform renders the Payment Transaction Failed Reminder email template. Active exploitation by two distinct threat actors was first observed on September 4, 2026, with one actor deploying a persistent Rust-based implant disguised as system processes ([kworker/u:8:0], fc-cache, chronyd) and a second dropping PHP web shells into the product image cache. Adobe released hotfix VULN-39341 via APSB26-146 on September 7.

Tia coverage

First reported2026-09-07

First exploit report2026-09-08

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

adobe-releases-september-2026-patches-for-multiple-products-adob adobe-security-advisory-av26-888 cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca stylesmuggler-a-magento-zero-day-cve-2026-75650-delivering-a-rus

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.