Critical Commerce Exploit: Adobe Patches Magento Zero-Day "StyleSmuggler" Deploying Rust Backdoors (CVE-2026-75650)
Publication Date: September 9, 2026
Source Analysis: The Hacker News | Sansec Research | Adobe Advisory APSB26-146 | BleepingComputer
|---|---|
Executive Summary
Adobe has released an urgent out-of-band security bulletin (APSB26-146) addressing an actively exploited, critical remote code execution (RCE) zero-day vulnerability in Adobe Commerce and Magento Open Source. Tracked as CVE-2026-75650 and designated by cybersecurity research firm Sansec as "StyleSmuggler," the vulnerability allows unauthenticated remote attackers to execute arbitrary code on e-commerce web servers by poisoning transactional email templates.
Real-world attack telemetry confirms that cybercrime groups are actively weaponizing CVE-2026-75650 in the wild. Attackers submit malformed style attributes via public storefront checkout workflows and failed payment notifications, triggering template engine evaluation that drops stealthy PHP webshells and a compiled multi-platform Rust backdoor. The primary objective of the campaign is financial theft: injecting Magecart-style JavaScript payment skimmers to intercept customer payment card details during checkout.
Vulnerability Metric
Detail
Identifier
CVE-2026-75650
Common Name
StyleSmuggler
Impacted Software
Adobe Commerce & Magento Open Source
Vulnerable Versions
2.4.9-2026-aug, 2.4.8-2026-aug, and earlier
Primary Risk
Unauthenticated Remote Code Execution (RCE)
All merchant sites running the aforementioned versions are exposed and require immediate patching or virtual patching enforcement.
Deep-Dive Technical Analysis
1. The "StyleSmuggler" Injection Vector (CVE-2026-75650)
Magento’s server-side rendering architecture utilizes an internal template directive processor (based on customized Twig/Mustache parsing) to format transactional customer emails (such as order confirmations, shipping updates, and payment failure notices).
* The Flaw: In default configurations, customers can enter custom metadata during checkout or registration (such as custom delivery instructions or billing names). When an automated payment attempt fails (e.g., card processor rejection), Magento automatically compiles and dispatches a transactional "Failed Payment Notification" email to the user.
* Template Directive Bypass: Under CVE-2026-75650, Magento’s filter sanitization routines fail to properly sanitize nested inline CSS style directives (