Active Zero-Day in Adobe Magento (CVE-2026-75650) Exploited to Deploy Stealthy Rust Malware
Executive Summary
Adobe has released an urgent security advisory regarding an actively exploited zero-day vulnerability affecting Adobe Commerce and Magento Open Source, identified as CVE-2026-75650. Security observations indicate that threat actors are exploiting this flaw in targeted wild campaigns to achieve remote code execution (RCE) on unpatched e-commerce storefronts. These attacks focus on deploying a highly evasive, cross-platform backdoor written in Rust.
In response to the active exploitation, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026. Federal Civilian Executive Branch agencies have been mandated to patch their systems by September 11, 2026. This update is a critical component of a larger security release from Adobe that addresses over 170 vulnerabilities, including a maximum-severity command injection flaw in Adobe Campaign Classic (CVE-2026-82004, CVSS 10.0) and several critical RCE flaws in Adobe ColdFusion.
Deep-Dive Technical Analysis
1. Root Cause and Exploit Mechanics of CVE-2026-75650
The vulnerability CVE-2026-75650 is an unauthenticated remote code execution flaw. It originates from improper input neutralization and unsafe object deserialization within the core checkout and API endpoints of the Magento platform.
* Vector: Unauthenticated attackers initiate the exploit by transmitting crafted HTTP POST requests. These requests contain serialized payloads that are camouflaged as standard cart metadata or GraphQL query extensions.
* Trigger: The vulnerability is triggered when the PHP-based backend of Magento deserializes the incoming data. This process activates an object injection chain, enabling the attacker to perform arbitrary file creation and execution within the web root.
* Payload Deployment: Once initial compromise is achieved, threat actors drop a compiled, lightweight binary written in the Rust programming language. This Rust malware serves as a resident stealth backdoor designed to bypass traditional PHP-centric web application scanners and file integrity monitoring tools.
* Data Exfiltration: After establishing a foothold, the implant injects dynamic JavaScript skimming scripts into checkout pages. These scripts intercept sensitive customer data—including credit card numbers, CVVs, and billing addresses—in real time. The intercepted data is then encrypted and exfiltrated to bulletproof command-and-control (C2) servers.
2. Accompanying Critical Flaws Across Adobe's Portfolio
Adobe's emergency security advisory also addressed several other high-priority risks across its enterprise software suite:
CVE Identifier
Product
Severity (CVSS)
Vulnerability Type
CVE-2026-82004
Adobe Campaign Classic
10.0
OS Command Injection
CVE-2026-48273
Adobe ColdFusion
9.9
Critical Deserialization
CVE-2026-75746
Adobe ColdFusion
9.1
Critical Deserialization
The flaw in Adobe Campaign Classic (CVE-2026-82004) is particularly severe, allowing remote attackers to execute arbitrary shell commands with root privileges through crafted administrative payloads. The ColdFusion vulnerabilities allow for arbitrary remote code execution without requiring user interaction.
Industry Impact and Recommendations/Mitigations
Strategic Impact
The e-commerce sector remains a primary target for financial cybercrime syndicates. The shift toward using native compiled malware, such as Rust binaries, on traditional PHP web hosting stacks represents a technical evolution in digital skimming operations (Magecart). These compiled implants are specifically designed to render legacy signature-based file scanners ineffective, increasing the difficulty of detection for merchant security teams.
Actionable Recommendations & Mitigation Strategies
To defend against these threats, organizations should implement the following measures:
1. Immediate Patch Application: Priority must be given to applying Adobe's security patches for Adobe Commerce and Magento Open Source. Entities subject to CISA directives must ensure remediation is completed by the specified emergency deadline.
2. Scan for Native Binary Artifacts: Security administrators should inspect web server execution paths—including /tmp, /var/tmp, /dev/shm, and subdirectories within the web root—for unexpected ELF or Mach-O executable binaries, with a specific focus on those compiled in Rust or Go.
3. Deploy Web Application Firewall (WAF) Rules: Utilize strict virtual patching rules within WAF environments to identify and block anomalous serialized objects and malicious payloads targeting REST and GraphQL endpoints.
4. Enforce Subresource Integrity and Payment Gateway Isolation: Implement Content Security Policy (CSP) and Subresource Integrity (SRI) headers on all checkout pages. These headers are essential for preventing unauthorized third-party script injection and protecting against credential skimming.