StyleSmuggler (CVE-2026-75650): Adobe Commerce/Magento zero-day RCE exploited since Sept 4, patched Sept 7, added to CISA KEV

A CVSS 10.0 unauthenticated remote code execution zero-day in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, exploited in the wild since September 4, 2026, was fixed by Adobe hotfix VULN-39341 on September 7 and added to CISA's Known Exploited…

CVE-2026-75650, dubbed StyleSmuggler, is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3 and Magento Open Source 2.4.6-2.4.9 (per Tenable; Security Affairs cites Magento 2.4.7-2.4.9; Canada's Cyber Centre says versions prior to the August 2026 patch levels are affected). The flaw is exploited via malicious style properties that inject PHP code executed when Magento renders the Payment Transaction Failed Reminder transactional email. Active exploitation began September 4, 2026 — three days before Adobe shipped Hotfix VULN-39341 (APSB26-146) on September 7. Sansec and Disrex confirmed multiple victim stores across at least two distinct campaigns: one operator deployed a persistent implant at ~/.local/share/.gvfsd/gvfsd-user masquerading as kworker, fc-cache or chronyd, restored by a cron job (every five minutes, later twice hourly) and supporting x86-64 and arm64, while a second operator dropped a PHP web shell in product image caches. Tenable noted the flaw was not yet in CISA KEV as of September 8; on September 10 CISA added it to the KEV catalog alongside Windows privilege-escalation flaws CVE-2026-81963 and CVE-2026-85880 (CVSS 7.8 each) and N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0), with BOD 22-01 deadlines of September 11, 2026 for the non-Windows entries and September 22, 2026 for the Windows flaws. Adobe's wider release patched more than 170 vulnerabilities, including Campaign Classic command injection CVE-2026-82004 and critical ColdFusion RCE flaws CVE-2026-48273 and CVE-2026-75746, with per-product counts of Experience Manager (107), Acrobat Reader (32), Photoshop (8), plus Illustrator and Animate. Adobe and Sansec urge rotating encryption keys, admin passwords, API tokens and all source credentials. Akamai published further technical analysis on September 14. Related ecosystem developments: Canada's Cyber Centre (AV26-808 Update 1, September 10) flagged CVE-2026-71362 in Adobe Commerce as exploited in the wild per open-source reporting (tracked under APSB26-92), and Sansec reported that vendor Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical unauthenticated web shell upload flaws in Advanced Product Reviews and Gift Card, with a related Order Attributes flaw previously seeing over 12,000 blocked exploitation attempts against 25% of Magento stores in three days.