Magento StyleSmuggler CVE-2026-75650: Patch Guide

Published September 12, 2026 — San Jose, California. Adobe Commerce and Magento Open Source stores face a maximum-severity unauthenticated remote code execution vulnerability tracked as CVE-2026-75650, dubbed StyleSmuggler. The flaw was exploited in the wild for at least four days before Adobe shipped a hotfix on September 8, 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog with a September 11, 2026 FCEB deadline. Patching alone is insufficient — encryption keys must also be rotated.

Data last verified September 12, 2026 from Adobe Security Bulletin APSB26-146, Sansec forensic research, CISA Known Exploited Vulnerabilities catalog, and The Hacker News coverage.

Quick Answer

CVE-2026-75650 StyleSmuggler is a maximum-severity (CVSS 10.0) unauthenticated RCE in Adobe Commerce and Magento Open Source, discovered by Sansec on September 4, 2026 and exploited in the wild since then. Adobe shipped hotfix VULN-39341 on September 8, 2026 — three days after first observed exploitation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on September 8 with a FCEB deadline of September 11, 2026. The vulnerability allows attackers to inject PHP code via the template engine, which executes when Magento renders a 'failed-payment' email. Successful exploitation installs a Rust-based backdoor disguised as [kworker/u:8:0] or fc-cache, with C2 traffic disguised as NTP to port 123 (Adobe Security Bulletin APSB26-146; Sansec, September 2026; CISA KEV, September 8, 2026).

Affected versions and patch matrix

Source: Adobe Security Bulletin APSB26-146 (September 8, 2026).

Adobe explicitly directs customers to apply the VULN-39341 hotfix in addition to the September security updates — the September release does not eliminate the requirement. For Adobe Commerce on Cloud, use the Quality Patches Tool command to verify the hotfix shows an 'Applied' status. The hotfix is available from repo.magento[.]com/patch/VULN-39341-composer-patches.zip (Adobe, September 2026).

How the attack works

The vulnerability is in Magento's template engine. The attack chain:

1. Injection: The attacker injects custom styles into a Magento query (no authentication required).
2. Trigger: Magento generates a 'failed-payment' email — a routine event triggered by declined transactions, customer-initiated cancellations, or store admin actions.
3. Template render: When Magento renders the email template, it processes the injected styles, which contain PHP code.
4. RCE: The PHP code executes in the Magento server context, giving the attacker code execution.

Sansec's forensic research shows that the PHP dropper writes a web shell in addition to the Rust backdoor — multiple persistence paths to survive detection (Sansec, September 2026).

The backdoor: Rust-based, NTP-disguised C2

Two backdoor variants have been observed:

Source: Sansec forensic research (September 2026); BleepingComputer (September 7, 2026).

The malware determines the server's public IP using ipify, icanhazip, ident.me, and ipinfo.io to report back to the C2. It also checks Linux's TracerPid value to detect debugging — if tracing is active, the malware installs but does not beacon, avoiding detection by incident responders (BleepingComputer, September 7, 2026).

Detection: what to look for

Sansec published the following indicators for compromised stores:

• Unexpected 'Payment Transaction Failed Reminder' emails — the trigger event. A surge is a strong exploitation signal, though legitimate declined payments also trigger the email.
• Outbound UDP traffic to 247.cdnflare.xyz on port 123 — block this in your egress firewall and hunt for any historical connections.
• [kworker/u:8:0] or fc-cache processes — neither is legitimate on a Magento production server. fc-cache specifically should not be running from ~/.cache/fontconfig/.
• Cron jobs with 30-minute repetition — the backdoor's persistence interval.
• Web shells in the Magento installation directory — any PHP file with a recent modification date and unfamiliar content.
• Encrypted-key vault activity — if the encryption keys were exposed, look for unexpected decryption calls in the access logs.

Incident response: full containment checklist

Adobe and Sansec's guidance for stores that were exposed to the vulnerability (any unpatched store before the September 8 hotfix):

1. Apply the hotfix VULN-39341 immediately, before the September Commerce security release.
2. Rotate encryption keys — credit-card vault keys, admin API keys, customer-data keys.
3. Rotate credentials — admin passwords, SFTP keys, API tokens, database credentials, third-party integrations (payment gateways, shipping APIs, tax services).
4. Audit logs for the period between August 25, 2026 and September 8, 2026 (the likely exploitation window). Look for unexpected admin logins, payment-data exports, and outbound connections.
5. Search for web shells — diff the current Magento filesystem against a known-clean backup or the official release tarball.
6. Hunt for the backdoor — search for fc-cache in non-standard paths, [kworker/u:8:0] processes, cron jobs with 30-min intervals.
7. Block egress to 247.cdnflare.xyz on port 123 and UDP at the firewall; scan historical network logs for any connections.
8. Notify payment processors if credit-card data was stored (PCI DSS requires breach notification).

For stores that patched immediately on September 5 (when Adobe shipped the early hotfix to select merchants), exposure was minimal. For stores that delayed patching past September 8, assume compromise (Sansec, September 2026; Adobe Security Bulletin APSB26-146).

Why this attack is dangerous

StyleSmuggler is a textbook e-commerce threat:

• CVSS 10.0 — the highest severity rating.
• Unauthenticated — no credentials required, no user interaction.
• Exploited in the wild — not theoretical; active exploitation since September 4.
• Magento scale — 160,000+ installations, including 14,000 of the top 1 million websites, host payment data for millions of shoppers.
• Backdoor + web shell — multiple persistence paths mean a simple patch doesn't fully remediate; the patch is necessary but not sufficient.

Magento's widespread adoption, combined with its typical hosting on Linux servers with full PHP execution privileges, makes it a top-tier target for financially motivated threat actors (BleepingComputer, September 7, 2026).

FAQ

Did Adobe handle the disclosure well?
Adobe shipped the VULN-39341 hotfix three days after first observed exploitation (September 5 to select merchants, publicly September 8). CISA's standard KEV deadline is 14 days, which would have given Adobe until September 18; CISA set a tighter September 11 deadline because active exploitation was confirmed. Critics note that 4 days of in-the-wild exploitation is longer than the typical responsible-disclosure window. Adobe's September Commerce security release (APSB26-138) was published on time but does not eliminate the hotfix requirement (Sansec, September 2026).

Is my data encrypted at rest?
Magento stores credit-card data encrypted with AES-256 in the credit-card vault. The encryption keys are stored in app/etc/env.php. If your store was exposed to StyleSmuggler, those keys may have been exfiltrated. Rotating the keys is the only way to ensure previously-encrypted data cannot be decrypted by the attacker. Adobe's guidance: treat any pre-patch store as compromised (Adobe Security Bulletin APSB26-146).

Should I report this to customers?
If you confirm exploitation via the detection indicators, yes. PCI DSS requires notifying your acquiring bank and the card brands within 24 hours of suspected card-data compromise. State breach-notification laws (CA, NY, TX, etc.) require customer notifications within specific timeframes (typically 30-60 days). The GDPR (for EU customers) requires notification within 72 hours of becoming aware of a personal-data breach. Engage your legal team and a PCI-QSA before any public disclosure (PCI Security Standards Council; GDPR Article 33).