CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors

Adobe has released an emergency security update addressing a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that attackers are already exploiting in the wild. Tracked as CVE-2026-75650 and rated 10.0 on the CVSS scale, the flaw enables unauthenticated remote code execution on vulnerable e-commerce servers.

The vulnerability, dubbed StyleSmuggler by e-commerce security company Sansec, abuses Magento’s template-processing functionality to inject and execute malicious PHP code. Attacks were first confirmed on September 4, 2026, several days before Adobe released its emergency hotfix on September 7.

Threat actors have already used the zero-day to deploy a Rust-based Linux backdoor and, in separate attacks, a PHP web shell capable of executing arbitrary PHP commands. Because exploitation requires no valid Magento account or user interaction, internet-facing stores running vulnerable builds should be treated as high-priority targets for patching and retrospective investigation.

CVE-2026-75650 analysis

Adobe classifies the vulnerability as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. Its CVSS vector indicates network-based exploitation, low attack complexity, no privileges, and no user interaction, with potentially high impact to confidentiality, integrity, and availability.

The most important details for CVE-2026-75650 concern the way Magento turns attacker-controlled data into executable PHP during normal application processing. StyleSmuggler abuses template directives and internal dependency-injection functionality rather than relying on a malicious extension or administrator account.

At a high level, the known attack follows two stages. First, attacker-controlled PHP content is written into a file Magento can later access, such as an application log or report. A second request then causes Magento’s template-processing chain to reach dependency-injection scanner functionality that loads the poisoned file using PHP include or require_once. Because these functions interpret PHP rather than merely reading the file, the attacker-controlled code executes on the server.

Sansec describes another observable aspect of the chain: attackers deliberately trigger Magento’s normal Payment Transaction Failed Reminder email. The malicious code runs while Magento renders the template, so a customer or administrator does not need to open the email. The exploit can even succeed when actual email delivery fails.

Contact Sales

CVE-2026-75650 affects the following Adobe Commerce branches according to Adobe’s emergency bulletin:

• 2.4.9-2026-aug and earlier
• 2.4.8-2026-aug and earlier
• 2.4.7-2026-aug and earlier
• 2.4.6-2026-aug and earlier
• 2.4.5-2026-aug and earlier
• 2.4.4-2026-aug and earlier

Affected Adobe Commerce B2B versions include:

• 1.5.3-2026-aug and earlier
• 1.5.2-2026-aug and earlier
• 1.4.2-2026-aug and earlier
• 1.3.4-2026-aug and earlier
• 1.3.3-2026-aug and earlier

Magento Open Source branches through 2.4.9-2026-aug are also covered by Adobe’s bulletin.

Sansec independently reproduced the full unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations. Its first confirmed compromised customer was running Magento 2.4.6-p15 with both the July and August security updates applied, demonstrating that systems considered fully patched before September 7 were still vulnerable to the zero-day.

Once remote code execution is obtained, compromise extends beyond Magento itself. The first observed campaign deployed a small Rust-based Linux implant that established persistence and communicated with attacker infrastructure while disguising itself as legitimate system activity.

Early versions masqueraded as a kernel worker process named:

[kworker/u:8:0]

Later builds adopted names including:

fc-cache

and:

chronyd

The fc-cache variant stored itself under ~/.cache/fontconfig/fc-cache, added a cron entry to restart twice per hour, and used UDP port 123 traffic designed to resemble NTP communications. Sansec reported that related domains resolved to 185.157.160.251 as of September 7.

A separate attacker was observed abusing the same vulnerability to deliver a small PHP dropper. That payload created a hidden PHP web shell under a path resembling:

pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php

The shell normally returned an HTTP 404 response, but requests containing the required X-Cache-Token header could provide PHP code through a POST parameter for execution.

These observations show that StyleSmuggler is not tied to a single malware family or threat actor. Multiple adversaries can independently use the underlying RCE to deploy their preferred persistence and post-compromise tooling.

Sansec recorded the first confirmed exploitation on September 4 at 22:20 UTC. Another Magento server investigated by Disrex was compromised approximately 50 minutes later. Adobe released bulletin APSB26-146 and the official emergency hotfix on September 7, confirming that exploitation was already occurring in the wild.

A complete public CVE-2026-75650 PoC containing the assembled exploit request was not included in the sources reviewed. Sansec and Disrex have published extensive technical information about the underlying chain but intentionally withheld a fully weaponized request that would make exploitation trivial to reproduce.

Useful CVE-2026-75650 IOCs include suspicious processes and files associated with the Rust implant, unusual PHP files beneath Magento media directories, unexpected Payment Transaction Failed Reminder activity, and the infrastructure identified by Sansec. Defenders should also search for malicious report or log content rather than limiting investigations to the Magento webroot.

CVE-2026-75650 Mitigation

Adobe has classified APSB26-146 as Priority 1 and instructs affected customers to apply the dedicated VULN-39341 hotfix immediately. The official patch package is distributed through Adobe’s Magento repository for affected Commerce and Magento Open Source releases.

Adobe additionally instructs customers to rotate their encryption keys after applying the hotfix. This is particularly important for stores that were exposed before September 7 because successful arbitrary code execution may have allowed attackers to access application secrets and sensitive server-side configuration.

CVE-2026-75650 detection should therefore begin with three questions:

1. Was the store accessible from the internet between September 4 and installation of Adobe’s hotfix?
2. Was VULN-39341 successfully applied?
3. Are there signs that PHP or native processes were launched before remediation?

To Detect CVE-2026-75650 exploitation or post-compromise activity, security teams should look for:

• Unexpected bursts of Payment Transaction Failed Reminder emails
• Suspicious PHP content in Magento logs or files under var/report/
• Report files containing unusual x_trace_ strings
• Processes masquerading as [kworker/u:8:0], fc-cache, or chronyd
• ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/fc-cache
• Suspicious cron jobs restarting unknown binaries
• Unexpected PHP files underneath pub/media/
• Web shells under pub/media/catalog/product/cache/
• Outbound traffic to known StyleSmuggler infrastructure
• Abnormal UDP/123 communications from the Magento application host
• Unexpected HTTP requests involving unusual template-processing behavior
• New application users, changed credentials, or modified server configuration following suspicious web activity

Administrators should not assume that deleting a suspicious file from the Magento directory removes the compromise. In investigated incidents, malware relocated outside the webroot, created cron-based persistence, continued executing from deleted files, and could recreate parts of its persistence after removal.

The CVE-2026-75650 mitigation process should therefore include incident response for stores that were publicly reachable before patching. If compromise indicators are discovered, isolate the host, preserve forensic evidence, terminate malicious processes, identify persistence mechanisms, review filesystem changes, and rotate credentials and secrets accessible from the affected server.

Particular attention should be paid to:

• Magento administrator credentials
• Adobe Commerce encryption keys
• Database credentials
• API and integration secrets
• Payment and third-party service credentials
• SSH credentials
• Cloud or hosting tokens accessible from the application host

Security teams should also validate the integrity of Magento application files and extensions and investigate outbound network activity for signs that an implant communicated with external command-and-control infrastructure.

Because the initial StyleSmuggler attacks occurred before an official patch or public detection signatures were available, simply confirming that a store is now updated does not establish that it was never compromised. Any internet-facing vulnerable system operating during the September 4–7 zero-day window warrants historical review.