Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)
CVSS 10.0 template-injection in Adobe Commerce and Magento Open Source. Unauthenticated RCE exploited to plant Rust backdoors; emergency patch released September 8, 2026.
- Vendor
- Adobe
- Product
- Commerce and Magento Open Source
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.7%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-75650 is a CVSS 10.0 template-engine injection vulnerability in Adobe Commerce and Magento Open Source. An unauthenticated remote attacker can inject arbitrary template directives, which the server evaluates and executes as code.
The vulnerability was under active exploitation before Adobe published a patch. Attackers used it to deploy a Rust-compiled backdoor and a PHP web shell on compromised servers, per reporting by BleepingComputer and The Hacker News. The Rust binary reduces detection by signature-based tools; the PHP shell provides persistent server access.
Adobe released an emergency out-of-band patch on September 8, 2026. Affected version details and the corresponding fixed releases are in Adobe’s security bulletin.
CISA added this to the Known Exploited Vulnerabilities catalog on September 8 with a remediation deadline of September 11, 2026, under BOD 26-04.
After patching, check for unrecognized PHP files, unexpected binaries in web-accessible directories, and newly created user accounts. A patch closes the entry point but does not remove payloads already deployed.
