Act nowKnown exploited

Advisory · CVE-2026-75650

StyleSmuggler turns Magento payment emails into a backdoor

A template-engine flaw in Adobe Commerce and Magento Open Source lets an unauthenticated attacker inject PHP and get code execution during email rendering. Adobe shipped emergency hotfix VULN-39341; exploitation began before the patch.

Advisory published September 8, 2026Independent summary
Vendor
Adobe
Product
Adobe Commerce
Identifier / CWE
CVE-2026-75650
CWE-1336
Action timing
Sep 29, 2026
ELI5

Explain it like I’m five

A shop prints receipts from a template. An attacker slips instructions into the paper supply, and when the shop prints a routine payment-failed receipt, those instructions run as commands behind the counter.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Poisoned styles

    An unauthenticated attacker smuggles malicious PHP into Magento's template processing via request data.

  2. 02Failure report planted

    The payload is planted in data the application itself generates, such as a payment failure report.

  3. 03Email renders

    The attacker triggers the standard Payment Transaction Failed Reminder email path.

  4. 04Code executes

    Rendering the template executes the injected PHP with the web server's permissions, no click required.

What happened

Adobe security bulletin APSB26-146, published out of band on September 7, 2026 with a Priority 1 rating, addresses CVE-2026-75650, dubbed StyleSmuggler. The flaw is improper neutralization of special elements in the template engine (CWE-1336): an unauthenticated attacker can inject PHP code into Magento’s template-processing chain, which is later executed on the server during automated email rendering. The attack requires no authentication and no user interaction, not even delivery of the email. Adobe assigned CVSS 10.0 and stated it is aware of exploitation in the wild. Affected versions span Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B, and Magento Open Source (2.4.6 through 2.4.9 per community analysis). Sansec, which reported the flaw, tracked in-the-wild exploitation beginning September 4, three days before the hotfix. The fix ships as hotfix VULN-39341 rather than a tagged release. Public analysis of post-exploitation reports backdoors including a small Rust binary disguised as system processes and a PHP web shell placed in the product image cache. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026.

What to do

  1. Apply Adobe hotfix VULN-39341 (APSB26-146) to every Commerce and Magento Open Source instance immediately; being current on the August 2026 security updates is not a substitute.
  2. Audit the storefront for backdoors: review template files, the product image cache directory, and running processes for the disguised binaries reported in public analysis.
  3. If the store was internet-facing between September 4 and the hotfix, assume compromise: investigate access logs, review for unauthorized template modifications, and rotate encryption keys, API credentials, and payment integration secrets.
  4. Restrict network access to admin panels and monitor for repeat exploitation attempts, since multiple unrelated threat actors were observed hitting the same stores.

Management note

This is unauthenticated remote code execution on the platform that processes customer payments, exploited in the wild before a patch existed. Every day unpatched is a day attackers can plant persistent backdoors and harvest payment data. The hotfix is the emergency response; a forensic sweep for backdoors and a secrets rotation are the actual recovery.