Adobe has issued an emergency fix for a critical zero-day security vulnerability identified as CVE-2026-75650, affecting several versions of Magento and Adobe Commerce. The vulnerability, dubbed StyleSmuggler, has been exploited in real-world attacks since at least September 4, 2026, to plant backdoors on vulnerable e-commerce sites.
E-commerce security firm Sansec discovered the activity, while Adobe classified the vulnerability at its highest severity level, explaining that exploitation could lead to arbitrary code execution. The company recommended installing emergency fix VULN-39341 immediately, given that it is aware of CVE-2026-75650 being exploited outside test environments.
Affected Versions
The list of versions identified by Adobe includes:
- Adobe Commerce versions 2.4.4 through 2.4.9, including the August 2026 releases and earlier in each branch.
- Adobe Commerce B2B versions 1.3.3 through 1.5.3, with the August 2026 releases and earlier in each branch.
- Magento Open Source versions 2.4.6 through 2.4.9, with the August 2026 releases and earlier in each branch.
Indicators of Compromise and Attacker Techniques
One of the backdoors disguised the command-and-control server as a regular Network Time Protocol (NTP) server, but Sansec identified clear indicators on compromised systems, including emails with the subject “Payment Transaction Failed Reminder.”
In an update to its initial report, Sansec said a second attacker, using different tools, exploited the vulnerability to deploy a 485-byte PHP web shell. The file collects basic details about the server, checks whether the pub/media path is writable, and then exfiltrates the data through requests to a subdomain of oast.site, a domain commonly associated with security testing using the open-source Interactsh tool.
What Changes Practically for Store Administrators?
The response is not limited to installing the fix. After applying it, Adobe recommends enabling maintenance mode and suspending cron jobs, then rotating all secrets, including administrator passwords, GraphQL integration tokens, OAuth client secrets, payment gateway credentials, database credentials, SSH keys, and API keys. Once rotation is complete, the cache should be flushed, cron restarted, and maintenance mode disabled.
The importance of the news stems from the combination of three factors: a vulnerability with the highest severity rating, active exploitation, and potential access to platforms that handle order data and payment operations. Therefore, simply updating the system without assuming that credentials may have been exposed may not be practically sufficient if the site has already been compromised.
Operational limitations also remain that should be taken into account; Adobe officially tested the fix only with the August 2026 releases of the affected branches and said that it may work with other releases, but compatibility is not confirmed. The source also does not specify the number of compromised sites or the attackers’ identities, making examination of logs, files, and indicators of compromise a necessary step alongside updating.