What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
StyleSmuggler (CVE-2026-75650) is a critical, unauthenticated remote-code-execution flaw in Adobe Commerce and Magento Open Source. An attacker can poison Magento template-related content and then rely on Magento’s own server-side rendering of its “Payment Transaction Failed Reminder” email to execute PHP. The recipient does not need to open the email—and Sansec reports that failed email delivery does not necessarily stop execution.
How the payment-failure email becomes an execution path
The email is not a phishing lure that tricks a customer or administrator into clicking a link. It is part of Magento’s internal workflow: while composing a failed-payment reminder, Magento renders template content on the server. StyleSmuggler turns that normal rendering step into the execution trigger.
As an Amazon Associate I earn from qualifying purchases.
- An unauthenticated attacker sends a crafted request. Sansec says the exploit abuses
stylesproperties to evade existing safeguards. - The request poisons PHP into Magento’s template system. Sansec reports that the initial file may be created through a failure report.
- Magento later renders the poisoned content while generating its “Payment Transaction Failed Reminder” email.
- The server executes the PHP during rendering. Opening the resulting message is unnecessary, and Sansec says execution can still succeed if delivery fails.
Sansec reports reproducing the unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations. It also observed that moving sessions to Redis or the database did not stop every attack path; changing session storage should not be treated as a fix. Sansec’s technical account is at Sansec’s StyleSmuggler report.
Severity, exploitation, and affected releases
Adobe’s APSB26-146 bulletin, published September 7, 2026 and updated September 9, classifies CVE-2026-75650 as critical and assigns a CVSS 3.1 base score of 10.0. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: the attack is network-accessible, requires no privileges or user interaction, and can affect confidentiality, integrity, and availability beyond the vulnerable component’s security authority. Adobe states: “Adobe is aware of CVE-2026-75650 being exploited in the wild.” See Adobe APSB26-146.
Adobe identifies the flaw as improper neutralization of special elements used in a template engine (CWE-1336). Its affected-version ranges are product-specific:
| Product | Affected versions listed by Adobe |
|---|---|
| Adobe Commerce | 2.4.4-2026-aug through 2.4.9-2026-aug and earlier |
| Magento Open Source | 2.4.6-2026-aug through 2.4.9-2026-aug and earlier |
| Adobe Commerce B2B | 1.3.3-2026-aug through 1.5.3-2026-aug and earlier |
Use Adobe’s product and version table rather than assuming the Open Source and Commerce ranges are identical. Sansec says Adobe tested the hotfix against the 2026-aug releases across Commerce and Magento Open Source 2.4.4–2.4.9, and B2B 1.3.3–1.5.3; it says older releases within those branches are affected but the hotfix has not been verified on them. For out-of-support 2.2, 2.3, and 2.4.0–2.4.3, Sansec says Adobe publishes no fix. Sansec reports that Scandiweb backported patches for 41 older releases, but says those patches were not reviewed by Sansec; evaluate any such backport in staging and do not treat it as Adobe-endorsed.
Apply the specific hotfix, then confirm it
The remedy is Adobe’s CVE-2026-75650 hotfix, distributed as VULN-39341-composer-patches.zip from repo.magento.com and applied as a Composer patch, according to Sansec. Follow Adobe’s current installation notes for the appropriate release and supported tooling; do not substitute routine security updates for this specific fix. Adobe’s September 8 APSB26-138 bulletin explicitly says to apply the CVE-2026-75650 hotfix in addition to the bulletin’s regular updates. See Adobe APSB26-138.
- Review the current Adobe installation instructions and confirm the target product and version before applying the Composer patch.
- Apply the hotfix through the documented Composer-patch process, then complete any required deployment steps for your environment.
- Use Adobe-supported patch tooling to verify installation. Sansec gives this status check:
vendor/bin/magento-patches -n status | grep "39341|Status". Confirm the output identifies the patch as applied rather than relying only on a successful deployment command.
If exploitation may have happened, treat it as an incident
A successful patch closes the vulnerable path; it does not remove persistence an attacker may already have installed. Sansec specifically recommends checking for an implant and secondary backdoors when compromise is possible. A patched store therefore still needs a compromise assessment if it was exposed before remediation or there are suspicious signs.
- Scan the store and investigate unexpected PHP or template-related changes, implants, and secondary backdoors. Preserve relevant logs and involve your incident-response team or a qualified Magento security provider if you find signs of access.
- Rotate the encryption key and the credentials it protected at their source systems. Sansec lists admin passwords; REST, SOAP, and GraphQL integration tokens; OAuth client secrets; payment-gateway API credentials; database credentials; SSH and deploy keys; and third-party extension API keys.
- Do not assume that changing the encryption key alone invalidates credentials an attacker may already have read. Revoke or replace affected credentials in the systems that issued them, then update Magento integrations and deployment secrets.
Unexpected bursts of “Payment Transaction Failed Reminder” emails warrant investigation, but are not proof of exploitation: legitimate declined transactions can produce the same notifications.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Timeline and operator priorities
Sansec says attacks began September 4, 2026. Adobe published the emergency hotfix bulletin on September 7 and stated it knew of in-the-wild exploitation. The dates make prompt remediation important, but no victim count or prevalence rate is established by the cited sources.
Quick Recap
- Patch: apply and verify Adobe’s CVE-2026-75650 hotfix, while continuing to install applicable regular security updates.
- Assess: if the store may have been exposed before patching, scan for implants and backdoors rather than treating the patch as cleanup.
- Contain credential risk: rotate potentially exposed credentials at their issuing systems and update dependent integrations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
