Adobe Commerce max-severity bug comes under active attack
Attackers are actively exploiting CVE-2026-75650 (CVSS 10.0), an unauthenticated RCE zero-day in Adobe Commerce/Magento, deploying a Rust backdoor on e-commerce servers.
Sansec identified active exploitation of a CVSS 10.0 zero-day (CVE-2026-75650) in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, dubbed StyleSmuggler. The attack abuses crafted style properties in Magento template processing to execute PHP while rendering a 'Payment Transaction Failed Reminder' email, then launches a Rust backdoor connecting to C2 at 99.84.67.186 disguised as NTP traffic. Exploitation began September 4, 2026; Adobe released emergency hotfix VULN-393411, but Sansec also observed a second attacker deploying a PHP web shell in the product-image cache.
- Unauthenticated RCE achieved without victim interaction via Magento email template rendering
- Rust backdoor uses cron persistence, disguise process names, and C2 over UDP 123 as NTP
- Exploitation confirmed on versions 2.4.7-2.4.9 and patched 2.4.6-p15 since September 4
- Second attacker deployed a 485-byte PHP web shell in Magento product-image cache
- Defenders urged to hunt IoCs under pub/media, rotate credentials, and scan for implants
- CVEs
- CVE-2026-75650
- Malware
- StyleSmuggler
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 99.84.67.186 | launched. This is a small Rust program that connects to the 99.84.67.186 C2 server and waits for commands,” Sansec researchers said |
From the original article
3 min read at csoonline.com
Online stores running Adobe Commerce and Magento Open Source have been hit by a max-severity, zero-day bug that lets unauthenticated attackers execute code on vulnerable servers. Security firm Sansec is calling the flaw StyleSmuggler because of the way attackers abused Magento’s Style properties to inject malicious code past existing safeguards. “When the attack succeeds, a backdoor background process is launched.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.