CVE-2026-75650 StyleSmuggler: No-Auth Magento RCE Hit Stores 3 Days Before Adobe's Fix

StyleSmuggler targets Magento's email template rendering pipeline. Adobe Commerce and Magento Open Source include a template engine that evaluates variables embedded in template markup, including the styles property that controls CSS styling injected into generated emails. The styles field passes through a PHP parsing path that does not apply sufficient sanitization before evaluation.

An unauthenticated attacker sends a single HTTP POST request to the Magento endpoint responsible for email template configuration. The request sets the styles parameter to a PHP code string. Because authentication is not required at this processing step, the injected code is stored in the template's database record or evaluated in memory against the next render cycle.

Magento runs background cron jobs to process queued email notifications, including failed-payment alerts triggered by any checkout session. When the next failed-payment event occurs, the store's PHP-FPM worker renders the payment email template, evaluating the attacker's injected styles value as PHP code in the process. The execution context is the web server user, typically www-data or nginx, providing access to the store's database credentials, encryption keys, and the entire webroot filesystem.

The attack chain does not require any administrative login, any customer account, or any application session. An attacker targeting a large store can trigger the execution phase by initiating an abandoned checkout on a test product. On busy merchant sites, the background queue runs every few minutes, triggering execution automatically without attacker interaction after the initial injection request.

CVE-2026-75650 affects every version of Adobe Commerce and Magento Open Source from 2.4.4 through 2.4.9, including Adobe Commerce B2B 1.3.3 through 1.3.9. The vulnerability exists in the core template rendering architecture shared across all versions in this range, which means prior security updates to individual components did not remediate the flaw.

Merchants running cloud-hosted Adobe Commerce on Adobe's managed infrastructure received automatic patches through Adobe's cloud deployment pipeline following the September 7 hotfix release. On-premises merchants and those running hybrid or private cloud deployments must apply VULN-39341 manually.

Magento Open Source 2.4.4 and 2.4.5 reached end-of-life and do not receive Adobe's official hotfix. These versions should be treated as permanently vulnerable unless merchants upgrade to a supported version in the 2.4.6-2.4.9 range where the patch applies.

There are no architectural or configuration mitigations that eliminate the attack surface without applying VULN-39341. Disabling failed-payment email notifications reduces the automatic trigger path but does not prevent an attacker from injecting code and manually triggering execution through other queue events. WAF rules targeting the injection pattern provide detection and blocking capability for known attack signatures but cannot guarantee protection against obfuscated variants.

CVE-2026-75650 deployments confirmed during active exploitation carry two distinct implants that provide complementary persistence and access mechanisms.

The primary payload is a Rust-compiled binary. Rust executables are increasingly common in attacker toolkits because they produce small, self-contained binaries with no dependency requirements and no external libraries that endpoint detection tools can flag by filename or hash alone. The backdoor copies itself to a path that mimics a legitimate system daemon name and registers persistence to restart on process death. Its command-and-control communication runs over port 123 with traffic patterned to resemble NTP time-synchronization messages, exploiting the near-universal firewall rule that permits NTP outbound from servers.

The secondary payload is a PHP web shell dropped into Magento's /pub/media/ directory. This directory is served by the web server without PHP execution restrictions in default configurations. The media directory is intended for uploaded images, PDFs, and downloadable products. In standard Apache and Nginx configurations, PHP files in this directory execute normally unless the server has been explicitly configured to disable PHP in media paths. The web shell provides interactive HTTP-based command execution alongside the C2 channel maintained by the Rust backdoor.

Critically, the patch alone does not remove either implant. VULN-39341 modifies the template rendering pipeline to block the injection path, but leaves any files already written to disk and any database records already modified. Merchants who applied the patch without first scanning for compromise may have a fully patched store hosting an active backdoor. Review the IOCs in this post and run a full forensic scan before declaring remediation complete.

Two rules target the critical execution and C2 phases of CVE-2026-75650 StyleSmuggler exploitation. Both carry status: experimental. Validate against your environment before production deployment.

Shell spawn detection: PHP-FPM or web server workers spawning unexpected shell processes, the direct indicator of successful template injection code execution.

• Log sources: Linux audit, auditd, or sysmon-for-linux process creation telemetry from web server hosts

C2 channel detection: Outbound port 123 connections from web server process accounts to hosts outside your approved NTP server list. The StyleSmuggler Rust backdoor uses this as its primary C2 path.

• Log sources: Host-based network telemetry (Linux auditd with SYSCALL, sysmon-for-linux, or EDR agent network events)

Adobe released Hotfix VULN-39341 under security bulletin APSB26-146 on September 7, 2026. Apply the patch and complete a full compromise assessment before returning any store to production. VULN-39341 closes the injection path but does not clean an already-compromised environment.

For stores accessible during the September 4 to September 7 window, assume compromise and investigate before returning to production. CISA's KEV catalog listing confirms active exploitation, and multiple distinct attack groups operated during this window. The following steps address both the patch and post-compromise hygiene.

CVE-2026-75650 represents the highest-impact e-commerce platform vulnerability in recent years. Adobe Commerce and Magento power a significant portion of global e-commerce infrastructure, and a compromised store exposes not just the merchant but every customer whose payment data and credentials pass through it. The attacker does not need to breach a firewall or guess a password; the entire attack begins and ends via an HTTP POST request to a standard web endpoint.

The StyleSmuggler attack chain is notable for two structural characteristics that extend beyond this specific CVE. First, execution is deferred: the attacker injects code and then waits for the store's own background process to trigger it. This deferred execution pattern evades signature-based WAF rules that monitor request payloads in real time. The injection request itself may appear to be a legitimate template modification, with the malicious PHP code embedded inside a CSS-like parameter value.

Second, the Rust backdoor's NTP-mimicking C2 channel is designed to bypass the most common outbound firewall rule in server environments. NTP is almost universally permitted outbound from servers, and most organizations do not inspect UDP/TCP port 123 traffic beyond verifying it reaches known time servers. The backdoor exploits this assumption to establish a persistent C2 channel that survives standard firewall review.

For organizations managing customer-facing web applications running PHP frameworks, CVE-2026-75650 reinforces two controls that reduce exposure across vulnerability classes: enforcing strict execution policies in file upload directories (the media directory in Magento should never execute PHP), and deploying network-layer monitoring for unexpected outbound connections from web server processes. Both controls would have detected this attack pattern regardless of whether the specific CVE was known.

Defenders managing web application infrastructure should also review the CVE-2026-81578 PaperCut pre-auth RCE analysis, which demonstrated a similar deferred-execution pattern in a different application framework, and the CVE-2026-19490 Citrix NetScaler auth bypass post, which covered the same class of pre-authentication RCE impact on perimeter infrastructure.