# Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines Adobe has released a priority-1 emergency hotfix for CVE-2026-75650, the StyleSmuggler flaw being exploited against Adobe Commerce and Magento Open Source. The unauthenticated template-engine bug scores CVSS 10.0 and affects current 2.4.x branches even when stores had already applied the normal August security patch. This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected. - Status: Active - Published: 2026-09-10T22:28:07+12:00 - Updated: 2026-09-10T22:28:07+12:00 - Categories: Web Development, PHP - Tags: Adobe Commerce, CVE-2026-75650, cybersecurity, Magento, remote code execution, StyleSmuggler - Canonical HTML: https://beyondthe.news/dossiers/adobe-commerce-magento-stylesmuggler-cve-2026-75650-active-rce ## What changed Adobe published out-of-band bulletin APSB26-146 on September 7 for CVE-2026-75650, a critical unauthenticated arbitrary-code-execution flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe assigns CVSS 10.0, priority 1 and confirms exploitation in the wild. Sansec, which named the campaign StyleSmuggler, says attacks began September 4, before the hotfix was available, and reproduced the chain on clean, current Magento installations. Adobe's remediation is a separate hotfix, VULN-39341, rather than simply the scheduled September Commerce release; Adobe's September bulletin explicitly tells customers to apply the CVE-2026-75650 hotfix in addition to normal security updates. ## Why it matters A store can be fully current on normal Magento patching and still have been exposed during the zero-day window. Because attackers had days of access before Adobe shipped the hotfix, remediation is not only about preventing the next request: operators need to check for compromise and rotate secrets that could already have been read. For commerce systems, that can include admin credentials, API/integration tokens, payment-gateway secrets, database credentials and deployment keys. ## The flaw is unauthenticated and maximum-severity Adobe classifies CVE-2026-75650 as improper neutralization in a template engine leading to arbitrary code execution, with no authentication required and a CVSS base score of 10.0. ## Exploitation preceded the vendor patch Sansec says it first confirmed exploitation on September 4 and reproduced the chain on clean supported versions. Adobe released APSB26-146 and the emergency hotfix on September 7, leaving a period where fully patched stores could still be attacked. ## The fix is separate from the normal September update Adobe's regular September Commerce bulletin explicitly instructs customers to apply the CVE-2026-75650 hotfix in addition to the scheduled security update. Operators should verify the hotfix itself is present rather than assuming a routine version update covered the issue. ## Patching cannot undo credentials already exposed Independent responders say compromised stores may have leaked secrets before the fix was installed. Adobe/Sansec guidance emphasizes key and credential rotation plus incident investigation when exposure or compromise is suspected. ## Key details - Adobe published APSB26-146 on September 7, 2026. - CVE-2026-75650 is rated Critical with CVSS 10.0. - Authentication is not required to exploit the flaw. - Adobe confirms exploitation in the wild. - Affected products include Adobe Commerce, Adobe Commerce B2B and Magento Open Source across current supported 2.4.x-era branches listed in the bulletin. - The remediation is hotfix VULN-39341. - Adobe's regular September security bulletin says the hotfix must be applied in addition to normal September updates. - Sansec says exploitation began September 4, before the Adobe hotfix was available. ## Builder takeaways - Verify the CVE-2026-75650 hotfix specifically; do not infer protection from being on the latest normal Magento/Commerce patch level. - Treat stores exposed before patching as potential incident-response cases, not merely patch-management tasks. - Rotate secrets at their actual source systems if compromise is suspected; changing only Magento's local encryption key does not invalidate credentials an attacker already copied. - Review failed-payment-email anomalies and other published indicators as hunting signals, but do not rely on one indicator to prove a store is clean. - Keep emergency vendor hotfixes in a separate operational checklist from scheduled Commerce release upgrades so out-of-band fixes are not missed. ## What to watch - Whether Adobe folds VULN-39341 into a future full Commerce/Magento release and how it marks the superseding versions. - New exploitation techniques or indicators from Sansec and other incident responders. - Evidence on compromise scale and affected merchant populations. - Any additional Adobe guidance on credential rotation or forensic investigation. ## Uncertainties - Public exploitation counts and affected-store totals are largely based on security-vendor telemetry and may not represent the whole Magento ecosystem. - A patched store may still require investigation if it was reachable during the pre-patch exploitation window. - The exact attack activity and compromise depth vary by victim; presence of a vulnerable version does not prove successful exploitation. ## Sources - [Security update available for Adobe Commerce | APSB26-146](https://helpx.adobe.com/security/products/magento/apsb26-146.html) — Adobe · primary security bulletin · 2026-09-07T00:00:00+12:00. Primary vendor source for affected versions, CVSS, no-auth RCE, active exploitation and hotfix. - [StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack](https://sansec.io/research/stylesmuggler-0day) — Sansec · specialist independent research · 2026-09-05T00:00:00+12:00. Independent discovery and incident-response evidence for exploitation timing, supported-version exposure and remediation context. - [Security update available for Adobe Commerce | APSB26-138](https://helpx.adobe.com/security/products/magento/apsb26-138.html) — Adobe · primary security bulletin · 2026-09-08T00:00:00+12:00. Confirms the emergency hotfix remains separately required in addition to the scheduled September security release.