Adobe Commerce Magento RCE Vulnerability Under Attack
An Adobe Commerce Magento RCE vulnerability nicknamed StyleSmuggler let attackers plant Rust-based Linux backdoors on live webshops for at least five days before Adobe shipped a fix. Tracked as CVE-2026-75650 with a maximum CVSS score of 10.0, the flaw requires no authentication and has already been used to backdoor real merchant sites, not just proof-of-concept demonstrations.
What Happened
This Adobe Commerce Magento RCE vulnerability was discovered by security firm Sansec, which found that attackers have been exploiting CVE-2026-75650 since at least September 4, 2026, three to four days before Adobe’s patch existed. The vulnerability abuses Magento’s own template engine: a crafted input gets rendered into a routine “Payment Transaction Failed Reminder” email, injecting and executing arbitrary PHP code in the process — no login, no admin panel access, and no user interaction required. The flaw affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across every version from 2.4.4 up to and including 2.4.9.
Once inside, attackers deployed a Rust-based Linux backdoor whose command-and-control traffic is disguised as ordinary Network Time Protocol (NTP) requests — a detail designed specifically to blend into normal server traffic and evade network monitoring built around HTTP/HTTPS anomalies. PHP web shells were also planted for simpler, lower-effort follow-up access. Adobe released hotfix VULN-39341 as a Composer patch on repo.magento.com on September 7–8, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 8.
Why It Matters
Adobe’s own advisory recommends merchants rotate their encryption key and every credential that key protects — not just apply the patch. That is a strong signal from the vendor that patching alone will not evict an attacker who was already inside during the five-day exploitation window. Magento and Adobe Commerce are among the most widely deployed self-hosted webshop platforms for German and Austrian mid-market retailers and B2B manufacturers running their own storefronts, a segment that rarely appears in edge-device or ERP-focused vulnerability alerts but carries the same exposure: customer payment data, order history, and stored credentials all sit behind this template engine.
What You Should Do Now
- Apply Adobe’s hotfix VULN-39341 immediately via Composer from repo.magento.com — this is not optional even if the storefront “looks fine.”
- Verify: check whether your Magento/Adobe Commerce version falls in the affected range (2.4.4 through 2.4.9) and confirm the hotfix is actually installed, not just scheduled.
- Rotate the Magento encryption key and every credential it protects (payment gateway keys, integration tokens, admin passwords) — Adobe’s own guidance, not a precaution DIESEC is adding.
- Monitor for the NTP-disguised backdoor traffic (unexpected outbound UDP 123 traffic patterns) and hunt for unexpected PHP files in template and media directories.
If your store runs on an unpatched version and shows any signs of unusual outbound traffic or unfamiliar files, treat this as a suspected compromise requiring credential rotation, not just a missed patch.
DIESEC Perspective
The pattern here is familiar from 2026’s other self-hosted-platform incidents: a routine, everyday feature — in this case, a payment-failure reminder email — turned into the entry point, because the underlying template engine trusted input it should not have. Vendor-recommended credential rotation after patching is a meaningful signal that “patched” and “clean” are not the same status, something we see Mittelstand webshop operators conflate more often than enterprise IT teams.
Not sure whether your Magento or Adobe Commerce installation is still exposed, or whether an attacker was already inside during the exploitation window? Contact DIESEC for a rapid patch verification and compromise assessment.
Sources: Sansec | The Hacker News
Published: 2026-09-10 | Category: Vulnerabilities & Patches | ~4 min read
