Magento Patch Released for Actively Exploited Flaw

Adobe has shipped an emergency security patch for Magento and Adobe Commerce after confirming that attackers are actively exploiting a critical vulnerability in the wild. The flaw, tracked as CVE-2026-75650, carries the maximum CVSS score of 10.0, which is the highest possible rating on a widely used scale for measuring risk. The issue is a zero-day because active attacks began before the vendor released a fix on Monday. Dutch e-commerce security company Sansec, which named the issue StyleSmuggler, said it first observed zero-day exploitation on September 4, 2026.

The vulnerability abuses Magento's template system through PHP code injection. In plain terms, an attacker injects malicious PHP commands into the part of the store that builds a 'Payment Transaction Failed Reminder' email. When the store processes that email template, the injected code runs, giving the attacker the ability to execute commands without needing a valid login. Adobe confirmed that the update resolves a critical vulnerability that could result in arbitrary code execution, and that it is aware the flaw has been exploited in the wild targeting Adobe Commerce merchants. In practice, arbitrary code execution means an attacker can run any command, which can include reading files, changing store data, or installing other malware.

Adobe said the flaw affects the following releases: Adobe Commerce 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier, 2.4.5-2026-aug and earlier, and 2.4.4-2026-aug and earlier; Adobe Commerce B2B 1.5.3-2026-aug and earlier, 1.5.2-2026-aug and earlier, 1.4.2-2026-aug and earlier, 1.3.4-2026-aug and earlier, and 1.3.3-2026-aug and earlier; and Magento Open Source 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, and 2.4.6-2026-aug and earlier. Adobe has released a hotfix available for download from repo.magento.com/patch/VULN-39341-composer-patches.zip. The company said merchants must apply the VULN-39341 patch for their version and rotate their encryption keys, the secret values used to protect sensitive data.

Sansec reported that attackers are using CVE-2026-75650 to deploy a Rust-based Linux backdoor. A backdoor is a hidden way for an attacker to regain access later. This particular backdoor connects to an external server and waits for further instructions. Separately, the vulnerability has been abused to deliver a PHP dropper that writes a web shell on susceptible sites. A web shell is a file placed on a website that lets an attacker run PHP commands through a web page, effectively giving full control of the server. Netherlands-based Disrex said a Magento server it monitored was compromised about 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026, at 10:20 p.m. UTC. Disrex described the attack as turning Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain, meaning no login is required. This shows how quickly an unpatched store can be targeted after a public report.

Previdian, another security firm, recorded 12 exploitation attempts against its honeypots since September 7, 2026. A honeypot is a decoy system set up to observe attacks. The attempts came from two unique IP addresses located in China and Romania, but they were unsuccessful, according to Previdian founder and CEO Ryan Dewhurst.

For website owners and IT teams, the message is urgent: an unpatched Magento or Adobe Commerce store can be taken over within an hour. Applying the hotfix and rotating encryption keys should be the first step today. Merchants who need help coordinating urgent patches and reviewing their store's security posture can turn to AEU-I, AEU's security-first IT and consulting service, for patch management and security review support.