Post cover image

September 9, 2026

StyleSmuggler (CVE-2026-75650): Magento unauthenticated RCE, exploited in the wild

How the template chain works, what landed after RCE, and what security leads should do this week

By BreachlineLabs

5 min read

On 4 September 2026, attackers began exploiting an unpatched Magento and Adobe Commerce bug in the wild. Three days later Adobe shipped a Priority 1 hotfix. The flaw is now CVE-2026–75650, scored CVSS 10.0, no login required.

Sansec named it StyleSmuggler. If you run Magento Open Source or Adobe Commerce, this is not a theoretical advisory. It is an unauthenticated remote code execution chain that turns ordinary storefront traffic into code execution on your web host.

What broke

Adobe classifies CVE-2026–75650 as Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). Magento's template engine can be tricked into treating attacker-controlled content as executable code.

Impact: arbitrary code execution as the Magento process. Scope is changed, so the blast can reach beyond the vulnerable component. Adobe's bulletin APSB26–146 states authentication is not required and that Adobe is aware of exploitation in the wild.

Affected trains include Adobe Commerce 2.4.4 through 2.4.9 (including the 2026-aug builds), Magento Open Source on the same branches, and Adobe Commerce B2B 1.3.3 through 1.5.3. Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9. The first confirmed victim was already on the July and August 2026 security updates with a clean patch-status check. Being current was not enough.

How the exploit works

None

StyleSmuggler is a two-stage chain.

  1. Inject. The attacker poisons a file Magento writes, for example a failure report or another writable artefact. The payload abuses styles properties in a way that slips past existing safeguards on the template path.
  2. Execute. The attacker triggers Magento's standard "Payment Transaction Failed Reminder" email. While Magento renders that template, it executes the poisoned code.

Nobody has to open the email. Code runs during template rendering. The attack can succeed even when email delivery fails. A burst of failed-payment reminders can be a signal, but silence does not prove you were missed.

Sansec's timeline puts first confirmed exploitation at 22:20 UTC on 4 September 2026. Adobe published APSB26–146 and hotfix VULN-39341 at 20:20 UTC on 7 September. That is a three-day window where a clean, patched-looking store could still be taken with no login.

Timeline that matters

  • 4 Sep 22:20 UTC: first confirmed StyleSmuggler exploitation
  • 5 Sep: Sansec reproduces the chain on clean 2.4.7, 2.4.8, and 2.4.9; Shield rules start blocking
  • 6–7 Sep: implants rename themselves (fc-cache, then chronyd); a second actor drops a PHP web shell
  • 7 Sep 20:20 UTC: Adobe ships APSB26–146 and VULN-39341 (CVSS 10.0, Priority 1)

What attackers did after RCE

Once the chain lands, operators iterate quickly.

One campaign drops a Rust implant disguised as a Linux background process: early builds as [kworker/u:8:0], later as fc-cache or chronyd. Persistence often lands in cron. Command and control moved toward UDP port 123 traffic shaped like NTP, with hostnames that look like time-sync infrastructure. Before beaconing, the implant learns the store's public IP from common IP-echo services.

A second, unrelated operator used the same RCE to drop a small PHP web shell under the product image cache, gated behind a custom header so casual probes get a 404. That actor also sent GraphQL reconnaissance with PHP in a Store header to learn whether pub/media was writable before committing the shell.

Patching closes the hole. It does not remove an implant installed during the unpatched window. Adobe recommends rotating the Magento encryption key and every credential that key protected: admin passwords, integration tokens, OAuth secrets, payment gateway keys, database credentials, SSH and deploy keys, and third-party extension API keys. Rotate those at the source, not only inside Magento.

Why this matters for funded UK SaaS and ecommerce

If your product is a storefront, or you sell into merchants on Magento or Adobe Commerce, StyleSmuggler is a diligence and continuity event, not just a patch ticket.

  • Unauthenticated RCE on a customer-facing stack freezes renewals and questionnaires until you can show current proof.
  • "We applied last month's Adobe bulletin" was not a defence. The July and August updates were already on the first known victim.
  • Post-exploitation left real artefacts: disguised processes, cron entries, NTP-shaped egress, and PHP under media. Scanner coverage without adversarial follow-through misses that class of evidence.
  • Checkout and order paths sit next to the failed-payment email machinery the exploit abuses. That is exactly the surface buyers ask about when they want proof around payment and data access.

What you should do this week

None
  1. Confirm whether you run Magento Open Source, Adobe Commerce, or Adobe Commerce B2B in the affected trains.
  2. Apply Adobe hotfix VULN-39341 for CVE-2026–75650 and verify it is installed (check magento-patches status for 39341).
  3. Assume compromise until scanned. Hunt for Sansec's indicators: kworker / fc-cache / chronyd disguises, suspicious cron, PHP under pub/media.
  4. Rotate the encryption key and every dependent credential at the source if there is any chance you were hit between 4 and 7 September, or if you remain unpatched.
  5. Treat GraphQL exposure and writable media paths as part of the same incident narrative, not separate tickets.
  6. File the patch date, scan results, and rotation evidence into your diligence pack so the next questionnaire does not rest on a stale PDF.

How Nebula helps

BreachLine's Nebula is a fully autonomous AI security engineer · built for the AGI era. You hire it. You do not log in to it. Brief by email or Zoom / Google Meet / Microsoft Teams.

For a StyleSmuggler-class event, the useful work is adversarial and scoped:

  • Written approved scope around your storefront, GraphQL, checkout-adjacent paths, and the host or cloud edge that holds customer data.
  • Findings proven with a working exploit inside that scope, so "we think we are fine" becomes evidence you can defend.
  • Free retest after a fix, so the hotfix and remediations land as closed proof, not a verbal claim.
  • Always On / Its Own Desk: reports write themselves, Nebula raises the next move, and specialist agents work in parallel across the surfaces you authorise (web, API, cloud, and more when scope says so).

BreachLine holds Cyber Essentials. ISO 27001 and SOC 2 are in progress (not certified). CREST is not held.

Nebula does not replace Adobe's hotfix or ecommerce forensics. It is how lean security teams get continuous, scoped proof while product keeps shipping, including when the next CVSS 10.0 lands mid-quarter.

Takeaways

  • StyleSmuggler is unauthenticated Magento / Adobe Commerce RCE (CVE-2026–75650, CVSS 10.0), exploited from 4 September before the 7 September hotfix.
  • The chain poisons a writable artefact, then executes it while Magento renders the Payment Transaction Failed Reminder email.
  • Post-exploitation included Rust implants and a separate PHP web-shell operator. Patch without hunt and rotate is incomplete.
  • Diligence buyers care about current, scoped, exploit-backed evidence on the paths that hold money and customer data.
  • Hire Nebula when you need that proof loop under written approved scope, with free retest after fixes.

Sources