Adobe Patches StyleSmuggler, CVSS 10 Magento Zero-Day
Adobe's September 8 emergency update patches CVE-2026-75650, a CVSS 10.0 template-injection zero-day exploited to plant Rust backdoors in Commerce and Magento stores. CISA deadline: September 11.
Nadia "Loop" ParkAdobe released an out-of-band security update on September 8 for CVE-2026-75650, a CVSS 10.0 template-engine injection flaw in Adobe Commerce and Magento Open Source that attackers had already used to plant backdoors in e-commerce servers. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of September 11.
What the vulnerability is
The flaw sits in how both platforms process template rendering. An unauthenticated remote attacker can inject arbitrary template directives, which the engine evaluates server-side as executable code. Adobe’s advisory classifies it as improper neutralization of special elements used in a template engine. BleepingComputer, which has been tracking post-exploitation activity, is calling it “StyleSmuggler.”
This is not a new problem class for Magento. The platform’s template engine has a long surface area, and unauthenticated code-execution paths in the storefront layer have been used in production attacks before. CVE-2026-75650 is the same category, at the maximum severity score.
What attackers did with it
According to The Hacker News, confirmed compromise involved deploying a Rust-compiled backdoor and a PHP web shell. The Rust binary is harder to detect with signature-based tools; the PHP shell provides persistent, session-independent access to the server file system and execution environment. Both artifacts indicate threat actors with more than opportunistic intent: they built tooling for this specific platform before exploiting it at scale.
Adobe initially disclosed the vulnerability on September 6 as an unpatched zero-day already under active exploitation. The emergency patch followed two days later.
The patch and what versions are affected
The September 8 update covers multiple versions of Adobe Commerce and Magento Open Source. Adobe’s full list of affected versions and the corresponding fixed releases is in its security bulletin. If you are running any Commerce or Magento installation on your own infrastructure, that bulletin is the authoritative source for your specific version’s patch status.
SecurityWeek notes the September 8 release also included patches for over 170 other vulnerabilities across Adobe’s product line.
What to do
Apply the Adobe Commerce or Magento Open Source patch immediately. CISA’s September 11 deadline applies to federal agencies under BOD 26-04, but that three-day window reflects how actively this is being exploited, not a grace period for everyone else.
After patching, audit server logs and file systems for newly created PHP files or binaries in web-accessible directories. The presence of an unrecognized user account is also a compromise indicator, per N-able’s advisory for a related product patched the same week. If a PHP shell or unknown binary was planted before you patched, patching the entry point does not remove the payload.
The original 0dayNews report from September 6 covers the initial disclosure and the pre-patch exploitation window.
Related coverage: Attackers Exploiting Critical Adobe Commerce Flaw (August 2026), CISA KEV catalog explained.
- [ CRITICAL ]CVE-2026-75650Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)
Found this useful? Share it.
