StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento

A storefront can pass every routine security check and still be running an exploitable template engine. That is the situation Adobe Commerce and Magento Open Source merchants faced in September 2026, when attackers turned an ordinary transactional email into an unauthenticated remote code execution path.

The vulnerability is CVE-2026-75650, named StyleSmuggler by the Dutch ecommerce security firm Sansec. Adobe assigned it a CVSS score of 10.0 and published advisory APSB26-146 with hotfix VULN-39341. NVD records 9.8. The classification is CWE-1336, improper neutralization of special elements used in a template engine.

The attack chain

The flaw lives in how Magento renders template styles. An attacker first plants crafted PHP code inside data that Magento itself generates, such as a payment failure report. Then the attacker triggers the standard "Payment Transaction Failed Reminder" email. When Magento renders that template, it resolves the style attribute, and nothing in the pipeline prevents that attribute from carrying executable code. The polluted data runs with the permissions of the web server process.

No administrator login is required. No victim has to click a link. According to reporting on the incident, the attack completes even if the email is never actually delivered.

The post-exploitation payload is a small Rust backdoor. It disguises itself under process names such as [kworker/u:8:0], fc-cache and chronyd, which makes it easy to overlook in a process listing. Its command and control traffic is shaped to resemble NTP time synchronization over UDP port 123. Some variants copy themselves into the fontconfig cache directory and register a scheduled task that restarts them twice an hour, so a simple reboot does not remove them. A separate, smaller PHP web shell has also been observed in the product image cache directory.

Affected versions

Adobe lists the following as affected, and the list includes installations that had already applied the August 2026 monthly patches:

Adobe Commerce 2.4.4 through 2.4.9, including the -2026-aug releases and earlier
Adobe Commerce B2B 1.3.3 through 1.5.3, including -2026-aug and earlier
Magento Open Source 2.4.6 through 2.4.9, including -2026-aug and earlier

Sansec reported the first confirmed victim was running 2.4.6-p15, which was the latest release at the time and passed a security status check.

Timeline and exploitation status

Sansec observed exploitation starting 4 September 2026. Adobe released the hotfix on 7 September, a three-day window during which attackers operated against unpatched stores. CISA added CVE-2026-75650 to the Known Exploited Vulnerabilities catalog on 8 September with a federal remediation deadline of 11 September and a requirement for forensic investigation. On 7 September, the same day Adobe shipped the fix, Sansec observed a second, unrelated attacker using the same flaw to write a 485-byte PHP web shell, which means a single compromised store can host intruders who are unaware of each other.

Remediation

Apply Adobe hotfix VULN-39341 for your version. Adobe-hosted stores received the update through the managed pipeline. Versions 2.4.0 through 2.4.3 are end-of-life; Scandiweb published a backport that Adobe has not validated, so it needs staging verification before production use.

Patching closes the door but does not remove an intruder who arrived earlier. Adobe requires rotating the encryption key and all credentials. The order matters: rotate the encryption key first, because it protects the downstream secrets, then administrator passwords, REST and SOAP and GraphQL tokens, payment gateway API credentials, database accounts and SSH keys.

For detection, review the pub/media directory for PHP files that should not be there, look for unexpected processes and scheduled tasks, and check for outbound traffic to UDP port 123. Sansec and other vendors published scanning tools, including eComscan, that look for the Rust backdoor and secondary web shells.

Limitations

The CVSS score differs between sources: Adobe records 10.0 and NVD records 9.8. Both are included here rather than reconciled. The exact exploitation chain has been reproduced by researchers and a public proof of concept exists, but the descriptions above rely on vendor advisories and Sansec reporting rather than independent re-verification. The backdoor variants and their persistence mechanisms may change, so the detection guidance is a starting point, not a complete indicator set.