Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.
Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650, a max-severity zero-day dubbed StyleSmuggler affecting Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, enabling arbitrary code execution. Sansec reports the flaw has been exploited since at least September 4 to plant a backdoor whose C2 host is disguised as an NTP server, leaving traces like 'Payment Transaction Failed Reminder' emails. A second attacker with unrelated tooling is exploiting the flaw to deploy a 485-byte PHP web shell that collects server details, checks pub/media writability, and exfiltrates data to an oast.site subdomain. Adobe recommends immediate hotpatching plus rotation of all secrets including admin passwords, API keys, database credentials, and SSH keys.
- CVE-2026-75650 (StyleSmuggler) is a max-severity RCE zero-day exploited in the wild since at least September 4.
- Affects Adobe Commerce 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3, Magento Open Source 2.4.6-2.4.9.
- Exploitation plants backdoors with C2 disguised as NTP servers; a second actor drops a 485-byte PHP web shell.
- Adobe urges immediate VULN-39341 hotfix installation and rotation of all credentials and secrets.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | oast.site | s writable, and exfiltrates the data through requests to an oast.site subdomain, which is typically seen in security tests that u |
From the original article
2 min read at bleepingcomputer.com
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.