If you run Magento or Adobe Commerce, there is an important security update that should not be sitting in a backlog waiting for the next routine maintenance window.
A zero-day vulnerability known as StyleSmuggler is being actively exploited against Magento and Adobe Commerce stores. It is tracked as CVE-2026-75650 and has been given a CVSS score of 10.0, the highest possible severity rating.
Adobe released an emergency hotfix on 7 September 2026 under security bulletin APSB26-146 after exploitation had already been observed in the wild.
I’ve spent a good part of the last week rolling this fix out across Magento environments I work on. This is one of those updates where I would strongly recommend checking your patch status now rather than assuming that being on a recent Magento patch release is enough.
The short version
If you run a supported Magento 2 or Adobe Commerce store:
- Check whether CVE-2026-75650 / VULN-39341 has been applied
- Apply the correct Adobe hotfix for your Magento version if it has not
- Do not assume the normal September 2026 security patch includes this fix
- Review the store for signs of compromise
- Follow Adobe’s guidance on rotating encryption keys and associated credentials
- Continue with the normal September 2026 security updates as a separate task
Adobe has confirmed that CVE-2026-75650 has been exploited in the wild and rates the update Priority 1. The vulnerability can be exploited without authentication and can lead to arbitrary code execution on the affected server.
You can read Adobe’s official bulletin here:
Adobe Security Bulletin APSB26-146
Adobe has also published a more detailed remediation guide here:
Urgent Action Required: Critical Security Update Available for Adobe Commerce
What is StyleSmuggler?
StyleSmuggler is the name given to the vulnerability by ecommerce security company Sansec, which first reported active exploitation in early September.
At a high level, the vulnerability abuses Magento’s template handling and allows attacker-controlled code to be introduced into a path that Magento later processes.
The important part for merchants is the outcome rather than the exploit chain:
An unauthenticated attacker can potentially execute arbitrary code on the Magento server.
That makes this much more serious than a vulnerability that requires an existing admin account or another privileged level of access.
Adobe describes the underlying issue as improper neutralisation of special elements used in a template engine. The official CVSS vector reflects the fact that the attack can be performed remotely without authentication or user interaction.
Why this Magento vulnerability is particularly serious
There are a few reasons I would treat StyleSmuggler as urgent.
It is being actively exploited
This is not a theoretical vulnerability that was found internally and patched before anyone used it.
Adobe states directly that it is aware of CVE-2026-75650 being exploited in the wild.
Sansec says it first observed exploitation on 4 September 2026. Adobe’s hotfix followed on 7 September.
That gap is why this is described as a zero-day.
Authentication is not required
The attacker does not need an existing Magento admin account to attempt exploitation.
Adobe classifies it as unauthenticated arbitrary code execution.
Being recently patched was not enough
This is an important point.
Sansec reported exploitation against stores that were already on recent Magento patch levels. Its research also reproduced the issue on clean Magento installations.
In other words, you should not assume that a store is protected simply because July or August security updates were applied.
You need the specific CVE-2026-75650 hotfix.
A successful attack can lead to persistent access
Once an attacker is able to execute code on the server, this stops being a simple “patch the bug and move on” problem.
A compromised system may contain malicious files, processes, scheduled tasks or exposed credentials that remain relevant after the original vulnerability is closed.
This is why both Adobe and security researchers recommend looking beyond the patch itself if there is any reason to suspect exploitation.
Which Magento versions are affected?
Adobe’s APSB26-146 bulletin lists the following product branches as affected.
Adobe Commerce
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
- 2.4.5-2026-aug and earlier
- 2.4.4-2026-aug and earlier
Magento Open Source
Adobe’s bulletin lists:
- 2.4.9-2026-aug and earlier
- 2.4.8-2026-aug and earlier
- 2.4.7-2026-aug and earlier
- 2.4.6-2026-aug and earlier
Adobe’s remediation documentation also provides VULN-39341 hotfix files for a wide range of earlier 2.4.4, 2.4.5, 2.4.6, 2.4.7 and 2.4.8 patch levels.
Adobe Commerce B2B
Affected B2B releases are also listed in Adobe’s bulletin, including branches from 1.3.3 through to 1.5.3.
The safest approach is not to rely on a broad version summary from a blog post. Check your exact installed Magento or Adobe Commerce version against Adobe’s current hotfix matrix:
Adobe CVE-2026-75650 remediation guide
Adobe has already updated that page as more patch combinations have been made available.
What patch fixes StyleSmuggler?
Adobe tracks the fix as:
VULN-39341
For current versions, Adobe provides the hotfix through repo.magento.com as a Composer patch package. Other patch files are available for a number of earlier supported releases.
The exact file you use depends on the Magento version running on the store.
Do not take a patch file from another Magento release simply because the vulnerability number matches. Follow Adobe’s version table and apply the patch intended for your installation.
The official hotfix and installation guidance are available here:
Adobe Commerce CVE-2026-75650 hotfix instructions
The September 2026 Magento security patch is separate
This part is easy to miss.
Adobe released the emergency StyleSmuggler hotfix on 7 September.
The normal September 2026 Adobe Commerce security update followed on 8 September under APSB26-138.
They are separate updates.
Adobe specifically states that the September isolated security patch does not include the CVE-2026-75650 hotfix. Merchants need to apply the StyleSmuggler hotfix separately.
So this is not a case of:
“We’ve installed the September security patch so StyleSmuggler must be covered.”
Check it explicitly.
You can read the separate September security bulletin here:
Adobe Security Bulletin APSB26-138
What should Magento merchants do now?
For stores I maintain, I have treated this as an emergency security rollout rather than a normal upgrade.
At a minimum I would work through the following.
1. Confirm the exact Magento version
Do not start by guessing which patch you need.
Confirm the exact Magento Open Source or Adobe Commerce release and patch level running on each environment.
If you operate several stores, check them individually. It is common for production estates to have small differences between projects.
2. Apply the correct VULN-39341 hotfix
Use Adobe’s current version matrix and apply the appropriate patch through your normal deployment process.
Test where practical without leaving a vulnerable production store waiting unnecessarily.
For Adobe Commerce Cloud, Adobe documents a patch-status check using the Quality Patches Tool:
vendor/bin/magento-patches -n status | grep "39341\|Status"Adobe’s guide shows the VULN-39341 patch with a status of Applied when installation has succeeded.
For other hosting environments, verify the patch through the deployment and Composer patch process appropriate to the project.
3. Do not stop at patching if compromise is suspected
Applying the hotfix closes the vulnerability. It does not remove something that may already have been installed on the server.
If logs, monitoring or other indicators suggest that exploitation may have taken place, investigate the server properly.
Sansec is maintaining current technical indicators and attack information on its StyleSmuggler research page:
StyleSmuggler: Magento and Adobe Commerce 0-day RCE
Because the campaign has changed over time, I would use the latest research rather than copying a static list of indicators from an older article.
4. Pay attention to unexpected failed-payment emails
One unusual detail in the StyleSmuggler attack chain is its connection with Magento’s standard Payment Transaction Failed Reminder email.
Sansec says unexpected bursts of these emails can be a reason to investigate.
That does not mean every failed-payment email is an attack. Magento can generate the same message for legitimate failed payments.
It is also important to understand that nobody has to open the email for the exploit to work. The relevant processing happens while Magento renders the message.
So I would treat unusual failed-payment notifications as a possible indicator worth checking rather than proof of compromise.
5. Rotate credentials where required
Adobe’s remediation advice goes further than simply replacing Magento’s encryption key.
Adobe recommends rotating the encryption key and credentials that may have been protected by it or exposed through a compromised installation.
Its current list includes areas such as:
- Magento admin passwords
- REST, SOAP and GraphQL integration tokens
- OAuth client secrets
- payment gateway API credentials
- database credentials
- SSH and deployment keys
- credentials used by shipping, tax and other third-party integrations
Adobe makes an important point here: changing the Magento encryption key does not invalidate credentials that an attacker may already have obtained.
Those credentials need to be rotated at their source where appropriate.
Follow Adobe’s current remediation steps rather than using the list above as a replacement for the official guidance.
What about WAF protection?
Web application firewall providers have also responded to the vulnerability.
Cloudflare released an emergency managed WAF rule for CVE-2026-75650 / StyleSmuggler on 10 September.
That is useful additional protection if your Magento store sits behind Cloudflare’s applicable managed ruleset.
It is not a reason to avoid installing Adobe’s hotfix.
Cloudflare’s own advisory says origin applications should still be urgently updated and that potentially exposed credentials should be rotated.
You can read Cloudflare’s announcement here:
Cloudflare emergency WAF release for CVE-2026-75650
I would treat WAF protection as another layer rather than a replacement for fixing the vulnerable Magento application.
What if the Magento store is on an unsupported version?
This becomes more difficult.
Adobe’s official support and patch coverage is focused on supported Magento and Adobe Commerce releases.
Sansec has highlighted community backports for older Magento releases. These are not the same as an Adobe-supported fix and should be approached carefully.
If a production Magento store is on an unsupported release, StyleSmuggler is another strong reason to review the upgrade position rather than treating unsupported security backports as a permanent strategy.
For an older store I would:
- identify the exact release
- check Adobe’s current hotfix coverage first
- assess any third-party backport separately
- test changes in a representative environment
- plan a supported-version upgrade as a priority
Is the store safe once VULN-39341 is applied?
The hotfix protects against the vulnerable code path addressed by CVE-2026-75650.
That is not the same thing as proving that a server is clean.
If the store was exposed while active exploitation was taking place, patching tells you what the system looks like now. It does not tell you what happened before the patch was installed.
The level of investigation required depends on the store, its exposure, available logs and any signs of suspicious activity.
At the very least I would retain relevant logs and review the current indicators published by Adobe and Sansec.
For a store with credible signs of compromise, I would treat it as an incident rather than a routine Magento maintenance job.
Why I think this update deserves extra attention
Magento security releases are not unusual.
This one is different because all of the things you do not want to see appear together:
- maximum CVSS score
- no authentication required
- remote code execution
- exploitation before the vendor patch
- active attacks confirmed by Adobe
- recently patched Magento versions still being exposed before VULN-39341 was released
That combination is why I have prioritised the StyleSmuggler patch across the Magento installations I work with.
If your Magento support provider has not discussed CVE-2026-75650 with you yet, I would ask them to confirm whether the relevant VULN-39341 hotfix has been applied.
Official StyleSmuggler and CVE-2026-75650 resources
These are the sources I would use for current information:
- Adobe Security Bulletin APSB26-146
- Adobe’s CVE-2026-75650 hotfix and remediation guide
- Adobe Security Bulletin APSB26-138 - September 2026 security update
- Sansec StyleSmuggler research
- Cloudflare emergency WAF rule announcement
Both Adobe and Sansec have updated their guidance as the incident has developed, so I would check the live versions of those pages rather than relying solely on information copied elsewhere.
Final thoughts
If you run Magento or Adobe Commerce and have not yet checked for CVE-2026-75650, I would do it now.
StyleSmuggler is not simply another Magento security advisory to add to an upgrade list. Adobe has confirmed exploitation in the wild and has released a specific emergency hotfix for the issue.
Apply the correct patch for your version, confirm that it is in place and follow Adobe’s credential-rotation guidance where required.
If there are indicators that the store may have been targeted, investigate that separately rather than assuming the patch itself cleans up an earlier compromise.
I provide hands-on Magento development and ongoing technical support for Magento stores. If you need help checking your current patch level, applying the StyleSmuggler hotfix or reviewing the wider security position of an existing Magento installation, feel free to get in touch.