StyleSmuggler Critical Adobe Commerce and Magento Zero Day Exploited for RCE (CVE-2026-75650)

🛡️ Verified Threat IntelDigitalSpying Research Desk

📅 September 10, 2026⏱️ 5 min read

StyleSmuggler: Critical Adobe Commerce & Magento Zero-Day Exploited for Remote Code Execution (CVE-2026-75650)

By DigitalSpying Threat Research Team

Published: September 10, 2026

Target: E-Commerce Platforms, Retail SecOps, Payment Gateways

Executive Summary

On September 5, 2026, cybersecurity research firm Sansec published emergency findings regarding "StyleSmuggler", an unauthenticated remote code execution (RCE) zero-day vulnerability actively exploited in the wild against Adobe Commerce and Magento Open Source platforms. Assigned CVE-2026-75650 and carrying the maximum possible CVSS v3.1 score of 10.0, the flaw enables unauthenticated remote threat actors to inject malicious server-side template payloads that trigger remote code execution on the underlying server, deploying stealthy Rust-based backdoors and skimming customer credit card telemetry.

Active exploitation was first identified on September 4, 2026, striking production e-commerce storefronts that had fully applied all July and August 2026 security updates. Following urgent coordination, Adobe issued emergency security bulletin APSB26-146 on September 7, releasing isolated hotfixes across supported release lines. Concurrently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog on September 8, while Australia's ASD/ACSC issued high-priority warnings to merchants nationwide. Because threat actors established persistence on servers before patches were published, security teams must treat this as a dual-track incident: applying the official hotfix while conducting rigorous compromise assessments.

Technical Deep-Dive & Attack Chain

StyleSmuggler is a complex, multi-stage injection vulnerability that turns Magento’s internal logging and transactional email rendering pipeline against itself.+-----------------------------------------------------------------------------------+

| StyleSmuggler Attack Architecture |

|---|+-----------------------------------------------------------------------------------+

| |

| [Attacker] |

| | |

| | 1. HTTP Request with embedded malicious PHP in headers/parameters |

| v |

| [Magento Public Endpoint] |

| | |

| | 2. Unhandled exception / transaction failure logged |

| v |

| [Local File System (e.g., var/log/ or var/report/)] <--- Payload Planted |

| | |

| | 3. Attacker triggers "Payment Transaction Failed Reminder" routine |

| v |

| [Email Template Processor / CSS Inliner] |

| | |

| | 4. Directive evaluates planted file as local CSS template resource |

| v |

| [PHP Interpreter Execution] |

| | |

| | 5. Malicious PHP executed with web server privileges (www-data) |

| v |

| [Rust Backdoor Binary Deployed (/tmp/.systemd-daemon)] |

| |

+-----------------------------------------------------------------------------------+

1. Stage 1: Log Injection / Payload Smuggling

The initial phase involves planting malicious PHP code into an arbitrary server-side file that Magento is permitted to write to. Attackers transmit malformed HTTP requests containing payload fragments disguised as payment metadata or customer identifiers. When Magento encounters a processing error or simulated payment gateway timeout, it serializes the error event and writes it to a failure report or application log file (such as var/log/system.log, var/log/exception.log, or files under var/report/).

2. Stage 2: Template-Driven Execution via Email Reminders

In the second stage, the attacker triggers Magento's built-in transactional notification workflow—specifically the "Payment Transaction Failed Reminder" email. Within the email template rendering engine, the template engine processes layout directives that dynamically inline styling rules.

StyleSmuggler abuses a path traversal and template directive parsing flaw that treats the planted log/report file as a valid local stylesheet template. When Magento renders the email layout on the server, the PHP engine parses the smuggled PHP tags embedded within the log file.

Crucially:

* No Human Interaction Required: The attack requires zero interaction from store administrators or customers.

* No Email Delivery Required: The code executes during the server-side rendering phase before transmission; the attack succeeds even if the outbound SMTP server fails or email delivery is completely blocked.

3. Post-Exploitation & Payload Deployment

Telemetry from Sansec and NetSPI demonstrates that immediately upon gaining initial PHP execution, threat actors drop and execute an obfuscated, compiled 64-bit Linux ELF binary written in Rust. The binary establishes an outbound encrypted Command-and-Control (C2) beacon, hooks payment checkout controllers to harvest credit card numbers in real-time, and inserts hidden administrative user accounts directly into the admin_user database table.

Vulnerability Impact Matrix