CVE-2026-75650

Published Sep 7, 2026

Last updated a month ago

Exploit knownCVSS critical 10.0
Adobe Commerce
Network
Magento 2
StyleSmuggler

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-75650 is a zero-day vulnerability, identified as "StyleSmuggler," affecting Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9 and earlier. This flaw allows unauthenticated attackers to achieve remote code execution. The vulnerability operates by injecting malicious code into Magento's template system. Attackers can poison PHP code, for instance, by generating a failure report, and then trigger its execution through mechanisms like a failed payment email. Adobe has released an emergency hotfix, APSB26-146, to address this issue.

Description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Source
psirt@adobe.com
NVD status
Analyzed
Products
commerce, commerce_b2b, magento

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Exploit added on
Sep 8, 2026
Exploit action due
Sep 11, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@adobe.com
CWE-1336

Social media

Hype score
Not currently trending
  1. A double-whammy on Adobe Magento! CVE-2026-75650 - Adobe Magento - Critical 10.0 - Unauthenticated Remote Code Execution https://t.co/FBmDJ4OCKJ CVE-2026-48356 - Magento - Critical 9.3 - Unauthenticated Unrestricted File Upload https://t.co/VSHOcO4AqN https://t.co/yjkrCzz7Xc

    @abraxas_null

    26 Sept 2026

    76 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  2. 🚨 Actively Exploited Adobe Commerce and Magento Open Source Flaw Enables Unauthenticated RCE (CVE-2026-75650) Critical Vulnerability Alert! Adobe Commerce and Magento Open Source is affected by CVE-2026-75650. 🔍 Identify Targets via ZoomEye: Search Dork: app="Magento"

    @zoomeyebot

    21 Sept 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 Adobe Commerce and Magento Open Source RCE (CVE-2026-75650) Is Being Exploited in the Wild Critical Vulnerability Alert! Adobe Commerce, Adobe Commerce B2B, Magento Open Source is affected by CVE-2026-75650. 🔍 Identify Targets via ZoomEye: Search Dork: app="Magento"

    @zoomeyebot

    19 Sept 2026

    39 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Adobe Commerce CVE-2026-75650: CVSS 10.0, exploited Sept 4-7 before hotfix. Template injection deployed Rust backdoors, PHP web shells. If your Magento was live that window, patching isn't enough, you need incident response. #Cybersecurity #Magento

    @McM1Alex

    16 Sept 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. #Clients Protected Against #StyleSmuggler (CVE-2026-75650) in #Adobe_Commerce and #Magento #Open_Source https://t.co/FqX7VgtPYp https://t.co/g9RI3c1uLW

    @omvapt

    11 Sept 2026

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. 🚨 CISA ADDED 4 NEW KEVs CVE-2026-75650 — Adobe Magento Template Injection CVE-2026-81963 — Windows Update Stack Link FollowingCVE-2026-85880 — Windows ALPC Heap Overflow CVE-2026-86218 — N-able N-central Static Code Injection 📚 REF: https://t.co/Po8VyxR0tV https://t

    @ZeroHackHQ

    11 Sept 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. Unauthenticated RCE in Adobe Commerce and Magento (CVE-2026-75650) Adobe Commerce and Magento face a critical CVSS 10.0 template engine vulnerability (CVE-2026-75650) allowing unauthenticated remote code… Full write-up → link in bio #cybersecurity #infosec #cve #kev #adobe

    @HotaSamit

    9 Sept 2026

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🐦 🚨 Active exploitation: Chrome V8 0-day CVE-2026-87491 patched in-the-wild. N-able N-central CVE-2026-86218 (CVSS 10.0) pre-auth RCE hits CISA KEV. Adobe Magento CVE-2026-75650 zero-day (StyleSmuggler) exploited since Sept 4 - patch now. #infosec #CVE #0day

    @ita_ipo

    9 Sept 2026

    93 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の脆弱性を追加。 - Adobe Commerce/Magento: CVE-2026-75650(対処期限3日) - Windows: CVE-2026-81963, CVE-2026-85880 - N-able N-central: CVE

    @__kokumoto

    8 Sept 2026

    760 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Adobe Patches Critical StyleSmuggler Zero-Day Exploited in Magento (CVE-2026-75650) Adobe has released emergency hotfixes for CVE-2026-75650, a zero-day template injection flaw in Magento… Full write-up → link in bio #cybersecurity #infosec #VulnerabilityDisclosure #adobe h

    @HotaSamit

    8 Sept 2026

    77 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. StyleSmuggler: RCE sem login no Magento (CVE-2026-75650, CVSS 10.0). Exploração desde 04/09; hotfix Adobe no domingo. Patch sozinho não limpa o implante. https://t.co/5iaB3VMR1P #SmartCyber #Cibersegurança #SegurançaComInteligência

    @SmartCyberNews

    8 Sept 2026

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇

    @exploitgrid

    8 Sept 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  13. 🚨 Magento’da CVSS 10.0 Zero-Day: Aktif Saldırılar Adobe, CVE-2026-75650 (CVSS 10.0) açığını yamaladı. StyleSmuggler olarak adlandırılan açık, saldırganların uzaktan kod çalıştırmasına, Rust tabanlı backdoor ve PHP web shell yerleştirmesine izin veriyor.

    @KubbeSiber

    8 Sept 2026

    4 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 🐦 🚨 Actively exploited: CVE-2026-75650 (CVSS 10.0) — Adobe Commerce/Magento unauth RCE "StyleSmuggler", deploying Rust backdoors since Sep 4 (patched Sep 7). Also: CVE-2026-86218 N-able N-central pre-auth RCE (CVSS 10.0). Patch now. #infosec #CVE #0day

    @ita_ipo

    8 Sept 2026

    100 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. CVE-2026-75650 permite ejecutar código sin autenticación en varias versiones de Adobe Commerce y Magento Open Source. Adobe pide actualizar y aplicar el hotfix. https://t.co/LlTsocRW2i #AdobeCommerce #Magento #CVE202675650 https://t.co/6itjzPdQk5

    @UktusNas

    8 Sept 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. في ثغرات RCE على Magento، الاختبار المعزول ليس رفاهية؛ بل جزء أساسي من التحقق الأمني المسؤول. مختبر PoC الخاص بـ StyleSmuggler Magento CVE-2026-75650 يوفّر سياقاً عملياً لفهم مس

    @fad_777

    8 Sept 2026

    88 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. RCE PoC Lab for StyleSmuggler Magento CVE-2026-75650 https://t.co/8UCAUyvpKb

    @Dinosn

    8 Sept 2026

    1996 Impressions

    2 Retweets

    6 Likes

    6 Bookmarks

    0 Replies

    1 Quote

  18. Magento/Adobe Commerce alert: StyleSmuggler (CVE-2026-75650), a CVSS 10 unauthenticated RCE, is under active attack and deploying persistent Linux backdoors. Apply Adobe’s VULN-39341 hotfix now; inspect cron and fake kworker/fc-cache processes. https://t.co/MkWsKOrpYg

    @Shobhit

    8 Sept 2026

    65 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. 🚨 CVE-2026-75650 (CVSS 10): Adobe Commerce RCE Exploited in the Wild - Apply Hotfix Now Critical Vulnerability Alert! Adobe Commerce (Magento) is affected by CVE-2026-75650. 🔍 Identify Targets via ZoomEye: Search Dork: app="Magento" Exposure: 131.9k instances identified

    @zoomeyebot

    8 Sept 2026

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. Adobe released an emergency hotfix for CVE-2026-75650, a CVSS 10.0 zero-day in @Adobe Commerce and Magento that enables unauthenticated remote code execution via the template engine. The flaw is already being exploited in the wild. Adobe rates the update priority 1 and urges

    @WorldCyberNewsX

    8 Sept 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. 🛒 Adobe Commerce hit with a CVSS 10 critical: CVE-2026-75650 is a template injection flaw enabling unauthenticated RCE, no user interaction required. If you run Magento/Commerce, patch now. #cybersecurity #ciso #cto #vulnerabilities #msp #mssp https://t.co/do3jlXuBHg https://

    @SecAlertsCo

    8 Sept 2026

    84 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. An Adobe Commerce vulnerability, CVE-2026-75650 (CVSS 10), enables unauthenticated arbitrary code execution and is exploited in the wild. Patch now. #AdobeCommerce #Magento #StyleSmuggler #CVE202675650 #RCE #Ecommerce #ExploitedInTheWild #Infosec https://t.co/UbjLVAzAHF https://

    @Daily_CyberSec

    8 Sept 2026

    402 Impressions

    2 Retweets

    4 Likes

    1 Bookmark

    0 Replies

    0 Quotes

Configurations