Adobe issued an emergency hotfix on September 7 for the actively exploited Magento StyleSmuggler zero-day, now tracked as CVE-2026-75650. The company rated the flaw critical with a CVSS score of 10.0 and assigned its highest patch priority, warning that attackers can achieve arbitrary code execution without authentication on vulnerable online stores.

Adobe bulletin APSB26-146 covers Adobe Commerce branches 2.4.4 through 2.4.9, Magento Open Source branches 2.4.6 through 2.4.9, and Adobe Commerce B2B releases from 1.3.3 through 1.5.3. Earlier releases within the listed branches are also affected. Security firm Sansec, which named the vulnerability StyleSmuggler, first detected exploitation late on September 4 and said attackers began compromising stores before a vendor fix existed.

The flaw involves improper neutralization of special elements in Magento's template engine. According to Sansec, attackers inject PHP code through template style properties and then cause Magento to execute the poisoned content while generating a failed-payment email. No recipient needs to open the message, and exploitation can succeed even when delivery of the email fails.

Observed attacks installed a small Rust backdoor and disguised its processes as legitimate Linux components, including kworker, fc-cache, and chronyd. Sansec reported that newer variants shaped command traffic to resemble NTP over UDP port 123 and used cron or self-relaunch behavior for persistence. The researchers also documented a separate attacker using the same entry point to place a PHP web shell in Magento's product image cache.

Adobe recommends applying the CVE-2026-75650 hotfix immediately and updating installations to the newest supported version. Sansec identified the patch package as VULN-39341 and advised operators to scan for compromise because closing the vulnerability does not remove an implant already installed during the three days of observed exploitation before the hotfix. Unexpected failed-payment notices, suspicious cron entries, and non-root processes using the reported Linux service names warrant investigation.

Merchants that find evidence of compromise should preserve forensic evidence and rotate the Magento encryption key along with credentials it protected. Sansec relayed Adobe guidance covering administrator passwords, integration tokens, OAuth secrets, payment gateway credentials, database credentials, SSH and deployment keys, and third-party extension keys. Defenders should verify hotfix installation, inspect hosts beyond the web root, and continue monitoring as the campaign and its payloads evolve.