StyleSmuggler (CVE-2026-75650): Security Alert for Adobe Commerce and Magento Open Source Stores

Adobe has confirmed the active exploitation of a critical zero-day vulnerability in Adobe Commerce and Magento Open Source. Tracked as CVE-2026-75650 and named StyleSmuggler by security firm Sansec, the vulnerability carries a CVSS score of 10.0, the maximum possible severity rating. No authentication is required to exploit the store. Attackers have full control of the store, its database, and every credential it holds once compromised.

Who is Affected?

• Adobe Commerce
• Adobe Commerce B2B
• Magento Open Source
• All supported versions
• Unsupported versions including Adobe Commerce 2.4.5 and 2.4.6, as no official patch exists for these

StyleSmuggler Adobe Commerce Store Exploitation: Timeline

How StyleSmuggler Works

The StyleSmuggler attack runs in two silent stages. First, the attacker injects malicious PHP code into a file Magento writes during normal operation, such as a failure report or log. Second, the attacker triggers Magento's Payment Transaction Failed Reminder email. When Magento renders that template, the injected code executes, requiring no admin action and customer interaction. The store continues processing orders normally while the attacker has full server access.

The implant disguises itself as a legitimate Linux process and restarts automatically via cron. It survives a reboot.

Adobe Commerce Zero-Day Response: What to Do Right Now

Stop letting StyleSmuggler take over your store by applying the following steps on time:

Step 01: Apply the StyleSmuggler hotfix immediately

Apply hotfix VULN-39341 from bulletin APSB26-146, which is Adobe's emergency fix specifically for CVE-2026-75650 and is available from repo.magento.com.

Confirm it has been applied correctly using this command:

vendor/bin/magento-patches -n status | grep "39341"

Step 02: Apply the regular September security update separately

APSB26-138 is Adobe's regular September security release, which does not include the StyleSmuggler fix. Both must be applied independently.

Step 03: Find out whether the store was exposed

If the store was accessible between September 4 and September 7 without the hotfix applied, it may have been compromised before a patch existed. Check for these confirmed indicators of compromise:

• Unusual PHP files beneath Magento media directories
• Unexpected Payment Transaction Failed Reminder email activity
• Unfamiliar Linux processes restarting via cron
• Unexpected admin accounts or integration tokens

Step 04: Rotate all credentials

Adobe treats credential rotation as part of mandatory remediation, not an optional follow-up. Rotate in this specific order:

• Adobe Commerce encryption keys
• Admin passwords
• Payment gateway API credentials
• REST, SOAP, and GraphQL integration tokens
• OAuth client secrets
• Database credentials
• SSH and deploy keys

Beyond APSB26-146 Patch: What Exposed Stores Should Do

Applying the hotfix closes the vulnerability but does not remove an existing compromise. Stores that were running without the patch between 4th September and 7th Spetember need a thorough scan to detect any persistent implant, remove any secondary backdoors that StyleSmuggler may have installed, and confirm that no credentials were accessed before the patch was applied.

Adobe Commerce Store Unsupported Versions: Exploitation Risk

Adobe Commerce 2.4.5 and 2.4.6 lost regular support on August 11, 2026, with no official patch for CVE-2026-75650 existing for these versions.

Community backports are there but are not endorsed by Adobe. Therefore, upgrading to a supported release is the only permanent fix for merchants on unsupported versions. Running an unsupported version during an active exploitation campaign is a significant and immediate commercial risk.