Adobe Shipped an Emergency Patch for Magento's StyleSmuggler Zero-Day — Three Days After Attackers Got There First
CVE-2026-75650 scores a perfect CVSS 10.0. It hit a fully-patched store just as easily as a neglected one, and a paying customer of the vendor's own protection service was breached before the first blocking rule existed.
CVE Tools4 min read
On September 4, 2026, attackers started running unauthenticated remote code execution against Magento Open Source and Adobe Commerce stores using a bug that, at the time, had no CVE, no vendor advisory, and no patch. Dutch e-commerce security firm Sansec disclosed it the next day, naming it StyleSmuggler, specifically because — in their words — stores were "being compromised right now." Three days after the first attack, at 20:20 UTC on September 7, Adobe finally shipped an emergency hotfix and assigned it a CVE: CVE-2026-75650, CVSS 10.0, the maximum possible score.
Scores as of September 8, 2026live record →
How StyleSmuggler works: hide the code where nobody looks, then let Magento run it for you
The attack is two stages. First, an attacker manipulates a "styles" property in a crafted GraphQL request to plant malicious PHP inside a file Magento generates automatically during normal operation — a failure report or a log file. Second, StyleSmuggler forces Magento to generate its standard "Payment Transaction Failed Reminder" email, and the poisoned code executes the moment Magento internally renders that message. Nobody has to open the email, receive it, or even know it was sent.
The StyleSmuggler chain: from a GraphQL request to a persistent implant
- Attacker sends a GraphQL request with a poisoned 'styles' property
- PHP payload is planted inside a Magento-generated log/report file
- A DI-compiler-reserved class chain is forced to read the poisoned file
- Magento is made to generate a 'Payment Transaction Failed' email
- Poisoned code runs the instant Magento renders that email internally
- A PHP dropper cycles through 6 functions until one can spawn a process
- Persistent Rust implant installed, disguised as '[kworker/u:8:0]'
Being patched didn't help — until September 7
| Store | Magento version | Patch status | Outcome |
|---|---|---|---|
| Sansec's first identified victim | 2.4.6-p15 | Fully patched — July and August 2026 security updates applied | Compromised anyway |
| Disrex Group customer (Store A) | 2.4.8 | Paying customer of Sansec's own Shield protection | Breached 23:10 UTC Sept 4 — before any blocking rule existed |
| Disrex Group customer (Store B) | 2.4.7-p2 | Not a Shield customer, ~8 patch levels behind current | Breached 00:55 UTC Sept 5 |
Timeline: from first attack to emergency patch
- Active exploitation beginsSansec later reconstructs the start of real-world attacks against Magento Open Source and Adobe Commerce stores.
- Sansec discloses StyleSmuggler earlyNo CVE, no vendor advisory yet. Sansec publishes anyway, stating stores were being compromised in real time.
- Independent confirmation and hosting-provider responseDisrex Group confirms two breached customer stores. Hosting providers Nexcess and Liquid Web issue precautionary notices without confirming customer compromise.
- Adobe ships APSB26-146 and CVE-2026-75650Priority-1 (highest) bulletin, CVSS 10.0, with a composer-patch hotfix for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across the 2.4.4–2.4.9 lines.
What to do now
- Apply Adobe's hotfix from APSB26-146 immediately, regardless of your current patch level — being current did not protect the confirmed victims.
- Assume compromise until you've checked: Sansec's guidance looks for a marker in var/report/, but Disrex found real infections logged in var/log/system.log instead. Check both.
- Look for a process disguised as '[kworker/u:8:0]' running under your site's own user account — genuine kernel worker threads run as root with no resident memory, so one holding real memory under a web user is the tell.
- If you find or suspect compromise, rotate the Magento encryption key and everything it protects: admin passwords, REST/SOAP/GraphQL tokens, OAuth client secrets, payment gateway API keys, database credentials, and SSH/deploy keys.
- If you cannot patch immediately, Sansec's interim mitigation is to disable GraphQL where your storefront doesn't depend on it for headless or PWA delivery.
Data as of September 8, 2026live record →