On September 4, 2026, attackers began exploiting a zero-day remote code execution vulnerability in Magento and Adobe Commerce. No patch existed. Three days later Adobe shipped Hotfix VULN-39341. On September 8, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. The CVE is CVE-2026-75650. The nickname researchers gave it is StyleSmuggler. The CVSS score is 10.0.
How the attack works
Magento's template engine lets administrators configure transactional emails using a proprietary template language. Each template block supports style-related properties. StyleSmuggler exploits how Magento processes these properties: an attacker can inject PHP code into a style field in a template block. The injected code waits inside the template definition. It executes when Magento renders the Payment Transaction Failed Reminder transactional email, either from a genuine failed transaction or triggered by the attacker directly. No authentication is required to inject the payload or trigger the render path.
What attackers deployed after gaining access
Sansec documented two payloads in the active exploitation campaign. The first is a Rust-based Linux backdoor: a compiled binary providing persistent command execution that communicates with attacker infrastructure. Rust binaries are harder to detect with signature-based tools and resist many dynamic analysis environments, indicating a more sophisticated threat actor. The second payload is a PHP web shell dropped to the server's web root, providing an HTTP-accessible interface for command execution and file browsing. Both payloads are consistent with campaigns targeting e-commerce infrastructure for credential theft and payment data exfiltration.
Affected versions
CVE-2026-75650 affects Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9 inclusive. Adobe Hotfix VULN-39341, released September 7, 2026, addresses the vulnerability. Upgrading to a fully patched release is the preferred remediation. The hotfix is a workaround for environments that cannot upgrade immediately.
What to do right now
Apply the hotfix. FCEB agencies have until September 29 per the CISA KEV mandate. Commercial operators should treat this with equivalent urgency: exploitation was active three days before the patch existed.
Audit admin accounts and transactional email templates. Look for unfamiliar admin accounts created in the past two weeks and check Payment Transaction Failed templates for unexpected PHP in style properties.
Scan with Sansec indicators. Sansec published YARA rules for the Rust backdoor and PHP webshell. Run these against your web root and recently modified PHP files.
Why template injection keeps coming back
Template engines are designed to evaluate code at render time. Their security model depends entirely on ensuring user-controlled data never reaches the template evaluation context. When that separation fails, the template engine becomes a code execution primitive. StyleSmuggler demonstrates this failure mode in a mature, widely deployed e-commerce platform. The lesson is not specific to Magento: any application that evaluates template syntax at runtime is a potential target if the template content is not rigorously isolated from external input.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are responding to a StyleSmuggler compromise and need support.