Adobe has released an emergency patch for CVE-2026-75650 — the StyleSmuggler zero-day vulnerability in Magento Open Source and Adobe Commerce that has been exploited in the wild since at least September 4. Adobe’s own advisory states it is “aware of CVE-2026-75650 being exploited in the wild” and rates the vulnerability critical, with arbitrary code execution as the potential impact. The fix is delivered as hotfix VULN-39341 through the Adobe Experience League knowledge base rather than through a standard release cycle, reflecting the urgency of active exploitation.
The original campaign, discovered by Dutch e-commerce security firm Sansec, planted a persistent Linux backdoor that camouflaged its command-and-control server as an NTP host and reinstated itself within one second of removal. In a new development reported alongside the patch, a second unrelated threat actor has begun exploiting the same flaw — this group deploys a compact 485-byte PHP web shell that probes server details and exfiltrates data through an oast.site subdomain used by the Interactsh open-source penetration-testing tool. The presence of two independent attacker groups means exploitation is broadening. Adobe recommends that after installing the hotfix, administrators enable maintenance mode, suspend cron jobs, and rotate all credentials — administrator passwords, GraphQL integration tokens, OAuth client secrets, payment gateway API keys, database credentials, SSH keys — before resuming normal operations.
How to check if you’re affected
Affected versions include Magento Open Source and Adobe Commerce on the 2.4.7, 2.4.8, and 2.4.9 release lines. Adobe notes the hotfix has been tested against August 2026 releases of affected product branches; compatibility with other releases is not confirmed. To check your installed version, log in to the Magento Admin panel and navigate to System → System Information, or run php bin/magento --version from the store root. If your version is on an affected branch and the hotfix is not yet applied, treat the store as potentially compromised and follow Adobe’s post-installation credential rotation steps regardless.
Sources
- Adobe Security Advisory APSB26-146 (helpx.adobe.com/security/products/magento/apsb26-146.html — blocks automated access; visible in browser)
- BleepingComputer — Adobe fixes critical Magento zero-day exploited to backdoor servers
- Sansec — StyleSmuggler 0-day research