Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)

CVE-2026-75650 is a CVSS 10.0 template-engine injection vulnerability in Adobe Commerce and Magento Open Source. An unauthenticated remote attacker can inject arbitrary template directives, which the server evaluates and executes as code.

Template-engine injection occurs when user-supplied input reaches a server-side template renderer without sanitization. Adobe Commerce uses the Magento template framework to generate dynamic page output. In this flaw, an attacker passes crafted input through a public-facing endpoint, and the renderer processes it as code rather than data. Because template rendering runs with the web application’s server-level privileges, the resulting code execution has full access to the application environment and the underlying host.

The vulnerability was under active exploitation before Adobe published a patch. Attackers used it to deploy a Rust-compiled backdoor and a PHP web shell on compromised servers, per reporting by BleepingComputer and The Hacker News. The Rust binary reduces detection by signature-based tools; the PHP shell provides persistent server access.

Adobe released an emergency out-of-band patch on September 8, 2026. Affected version details and the corresponding fixed releases are in Adobe’s security bulletin. Merchants running self-hosted Adobe Commerce or Magento Open Source must apply the patch manually. Adobe Commerce Cloud deployments received the update from Adobe infrastructure.

CISA added this to the Known Exploited Vulnerabilities catalog on September 8 with a remediation deadline of September 11, 2026, under BOD 26-04. The three-day window reflects CISA’s assessment of active exploitation risk. Organizations outside the federal scope should treat that same deadline as a strong prioritization signal given confirmed pre-patch exploitation in the wild.

Adobe Commerce stores typically hold customer payment data, order histories, and account credentials. A pre-patch compromise may require investigation beyond patching, including log review and file integrity checks, to determine whether customer data was accessed or exfiltrated before the vulnerability was closed.

After patching, check for unrecognized PHP files in web-accessible directories, unexpected binaries, and newly created administrative accounts. A patch closes the entry point but does not remove payloads already deployed. Forensic indicators for the Rust backdoor and PHP shell associated with in-the-wild exploitation are detailed in the BleepingComputer report and the Adobe StyleSmuggler coverage article.

September 8, 2026 CISA KEV Batch

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on September 8, 2026 in a single enforcement update. All four carry confirmed active-exploitation status. CVE-2026-75650 and CVE-2026-86218 share the shortest remediation window (September 11); the two Windows CVEs have a September 22 deadline:

• CVE-2026-75650 (this entry): CVSS 10.0, Adobe Commerce and Magento Open Source template-engine injection, unauthenticated RCE, September 11 deadline
• CVE-2026-81963: CVSS 7.8, Windows Update Stack link-following privilege escalation, September 22 deadline
• CVE-2026-85880: CVSS 7.8, Windows ALPC heap buffer overflow, AppContainer sandbox escape, September 22 deadline
• CVE-2026-86218: CVSS 10.0, N-able N-central pre-authentication RCE, September 11 deadline

Organizations managing both web storefronts (Adobe Commerce) and Windows endpoints should treat this batch as a coordinated remediation priority rather than four unrelated patches.

FAQ

Do Adobe Commerce Cloud merchants need to apply the patch manually?

No. Adobe Commerce Cloud merchants received the patch automatically through Adobe’s managed infrastructure. The manual patching requirement applies to self-hosted Adobe Commerce and Magento Open Source installations. If you manage your own server, check Adobe’s security bulletin for the specific patch package for your version and apply it immediately if you have not already.

I patched after the September 11 CISA deadline. Could my store have been compromised before the patch?

Yes. CVE-2026-75650 was under active exploitation before Adobe published the patch on September 8. If your instance was internet-accessible and unpatched during that window, treat it as potentially compromised. Patching closes the entry point but does not remove any backdoors or web shells already deployed. Check for unexpected PHP files in web-accessible directories, unrecognized binaries, and newly created administrative accounts. The BleepingComputer report documents forensic indicators for the Rust backdoor and PHP shell observed in the wild.

Does this affect Magento Open Source as well as Adobe Commerce?

Yes. CVE-2026-75650 affects both Adobe Commerce and Magento Open Source. The vulnerability sits in the shared template engine code that both products use. Adobe issued patches for both in the same emergency security update. Check the Adobe security bulletin for the fixed version that applies to your specific edition and version line.