A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available.
Key takeaways
- CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication.
- Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different attack campaigns.
- Adobe released Hotfix VULN-39341 on September 7, 2026, and Tenable detection plugins will be published as they become available.
Background
Tenable's Research Special Operations Team (RSO) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding CVE-2026-75650, a zero-day remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that has been actively exploited in the wild.
FAQ
When was CVE-2026-75650 first disclosed?
On September 5, 2026, the Sansec Forensics Team published research detailing an actively exploited zero-day vulnerability in Magento and Adobe Commerce that it named StyleSmuggler.
What is CVE-2026-75650?
CVE-2026-75650 is a remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary code on a vulnerable server. CVE-2026-75650 carries a CVSSv3 score of 10.0, the highest possible rating. Additionally, its scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself.
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2026-75650 | Adobe Commerce and Magento Open Source Remote Code Execution | 10.0 |
The following products and versions are affected:
| Product | Affected versions |
|---|---|
| Adobe Commerce | 2.4.4 through 2.4.9 |
| Adobe Commerce B2B | 1.3.3 through 1.5.3 |
| Magento Open Source | 2.4.6 through 2.4.9 |
How does StyleSmuggler work?
StyleSmuggler exploits a flaw in how Magento's template engine processes style-related properties. An attacker crafts a malicious payload containing PHP code and injects it through the styles properties within the template system. Magento writes this attacker-controlled content to disk as part of its normal operations. The injected code is then executed when the platform renders a transactional email template, specifically the “Payment Transaction Failed Reminder” notification. Because this injection path does not sit behind any authentication gate, a remote attacker can trigger it without credentials, and the technique works regardless of which session storage backend is configured.
Once a server is compromised, the attacker deploys a persistent implant. The malware binary is installed at ~/.local/share/.gvfsd/gvfsd-user and masquerades as a Linux kernel thread using the process name [kworker/u:8:0]. It also disguises itself using the process names fc-cache and chronyd, both legitimate system utilities. A cron job restarts the implant every five minutes. Later variants updated the cron interval to twice an hour, and the malware supports both x86-64 and arm64 architectures.
Is CVE-2026-75650 being exploited in the wild?
Yes. Active exploitation of CVE-2026-75650 began on September 4, 2026 according to Sansec. Multiple victim stores have been confirmed across different attack campaigns. Disrex, an incident response firm, had first-hand experience with at least two compromised stores.
Historical exploitation of Adobe Commerce and Magento
Adobe Commerce and its open-source counterpart, Magento, have been recurring targets for attackers. Three prior Adobe Commerce and Magento vulnerabilities have been