Adobe Commerce and Magento Open Source are platforms that organisations use to run online stores. Adobe Commerce is the commercial, enterprise-oriented offering; Magento Open Source is its supported open-source counterpart. They sit behind retail, direct-to-consumer, B2B, wholesale and multi-brand storefronts, while Commerce B2B serves merchants with company accounts, purchasing roles and negotiated terms.
CVE-2026-75650, also called StyleSmuggler by researchers, is an improper-neutralization bug in the template engine: software that turns stored data into emails and storefront content. Adobe says a remote attacker needs neither an account nor user interaction to execute arbitrary code on the affected installation. That is the important boundary failure: attacker-controlled content can reach a place where Magento processes it as executable PHP rather than inert text, giving the attacker code execution as the current application user.
Adobe has confirmed exploitation against Commerce merchants. Researchers observed campaigns backdooring servers, including a Rust implant with process names resembling legitimate Linux processes and, in later activity, PHP web shells placed in the product-image cache. Reported persistence includes cron, and command-and-control was made to resemble NTP over UDP/123. A second operator reportedly began exploiting the bug on September 7. No public attribution identifies either operator.
The template path becomes a code-execution path
The reported chain can plant malicious PHP in data handled by Magento’s template system, including generated failure reports, then trigger processing when Magento renders a failed-payment transactional email. The email does not need to be opened or successfully delivered. That makes internet-facing checkout infrastructure the immediate concern, even for teams that assume email-template functions are an internal-only feature.
A public validation lab demonstrates the component-level PHP execution primitive and the patch boundary, with a deliberately harmless /tmp marker payload. It does not provide the complete unauthenticated HTTP chain. So a public PoC exists in that limited sense, but I could not confirm a public, working end-to-end exploit against a stock installation.
The patch's handling of serialized report data shows the basic defense: neutralize PHP opening tags and prepend an execution guard before writing the report.
- $this->directoryWrite->writeFile('report/api/' . $reportId, $this->serializer->serialize($reportData));
+ if (is_string($reportData)) {
+ $reportData = str_replace('<?', '< ?', $reportData);
+ }
+ $this->directoryWrite->writeFile(
+ 'report/api/' . $reportId,
+ self::REPORT_EXECUTION_GUARD . PHP_EOL . $this->serializer->serialize($reportData)
+ );Patch first, then treat the host as exposed
Adobe released hotfix VULN-39341 on September 7, not a new product version. Apply the version-matched hotfix immediately. Adobe lists affected Adobe Commerce branches from 2.4.4-2026-aug through 2.4.9-2026-aug and earlier; B2B branches from 1.3.3-2026-aug through 1.5.3-2026-aug and earlier; and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier. Its bulletin does not list Magento Open Source 2.4.4 or 2.4.5, so do not silently assume they are covered.
The hotfix has only been tested against the listed August releases. There is no identified normal release version containing the fix. Adobe also directs customers to rotate the Commerce encryption key and every credential it could protect or expose: administrator, integration, OAuth, payment-gateway, database, SSH, deployment and extension secrets.
As of September 8, CVE-2026-75650 was not confirmed as CISA KEV-listed; direct inspection of CISA's feed could not be completed because it returned HTTP 403. Patch before investigating, then review report and cache directories, cron, unexpected processes, outbound UDP/123 and access logs for compromise. SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs, but this one calls for immediate hands-on response.
