Critical Magento and Adobe Commerce Vulnerability Requires Immediate Store Review

What Happened

Adobe released an emergency hotfix for CVE-2026-75650, a critical vulnerability in Adobe Commerce and Magento Open Source that is already being exploited in real attacks.

The vulnerability was named StyleSmuggler by Sansec, an e-commerce security company. According to Sansec, attacks started on 4 September 2026, and Adobe released a hotfix on 7 September.

The issue is especially serious because it allows an external attacker to execute code on an affected online store without a username or password. Adobe rates the vulnerability at maximum severity — CVSS (Common Vulnerability Scoring System) 10.0.

Which Systems Are Affected

Affected systems include Adobe Commerce, Adobe Commerce B2B and Magento Open Source.

Adobe lists Adobe Commerce versions from 2.4.4 to 2.4.9, including their August 2026 releases and earlier versions in the respective branches. Adobe Commerce B2B versions from 1.3.3 to 1.5.3 are affected, as are Magento Open Source versions from 2.4.6 to 2.4.9.

This means the risk may affect both large online retailers and smaller merchants using Magento Open Source.

Why This Vulnerability Is Dangerous

An online store is not just a website. It is connected to orders, customers, payments, integrations, suppliers, warehouse systems, marketing tools and internal processes.

When an attacker can execute code on the server of an online store, the risk is not limited to changing pages. Hidden changes, persistence, data theft, malicious scripts and follow-on attacks against connected systems become possible.

In e-commerce, trust is directly connected to the moment of purchase. If a site is used to steal data or redirect users, the impact may affect customers, revenue, reputation and regulatory obligations.

How the Attack Works

According to Sansec, StyleSmuggler abuses how Magento processes templates and certain style properties. The attack allows malicious PHP code to be injected and later executed by the platform itself.

Sansec describes a two-stage model: first, malicious code is injected; then it is triggered through functionality related to an automatic failed payment email.

BleepingComputer reports that observed attacks used the vulnerability to plant a backdoor on affected servers. This allows attackers to return later, even after the initial compromise.

Why Patching Alone Is Not Enough

Adobe recommends applying the emergency hotfix immediately. But when a vulnerability is already being actively exploited, updating is only the first step.

The reason is simple: if the system was exposed before the fix, an attacker may already have added a backdoor, read sensitive configuration or gained access to keys and credentials.

Adobe instructs administrators to apply the fix and rotate encryption keys. Sansec recommends rotating all credentials protected by that key — administrator passwords, integration tokens, third-party service secrets, payment gateway credentials, database credentials, SSH keys and third-party extension keys.

This distinction matters: the hotfix closes the entry point, but it does not automatically remove traces of an existing compromise.

What Organizations Should Check

Teams that maintain Adobe Commerce or Magento Open Source should act in three directions: fix, verify and rotate credentials.

Practical checks:

• whether an affected Adobe Commerce or Magento Open Source version is in use;
• whether the hotfix for CVE-2026-75650 has been applied;
• whether the hotfix is confirmed as successfully applied;
• whether unusual files or changes exist in store directories;
• whether there are signs of backdoors or hidden scripts;
• whether unexpected failed payment emails are present;
• whether unusual outbound traffic from the server exists;
• whether encryption keys and protected credentials have been rotated;
• whether administrator accounts, integrations and payment connections have been reviewed;
• whether logs are sufficient for retrospective investigation.

The key question is not only “did we update the store.” It is “can we prove the store was not compromised before the fix.”

DIAMATIX Comment

From the DIAMATIX perspective, this case shows why online stores must be treated as critical business systems, not only as websites.

Platforms such as Magento and Adobe Commerce are often connected to payment services, warehouses, customer databases, marketing tools, partner systems and internal processes. That is why a critical vulnerability in the store can become a broader business risk.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes help in exactly these situations. They connect vulnerabilities, logs, server behavior, accounts, file changes and external signals to determine whether real compromise exists.

For actively exploited vulnerabilities, speed matters, but evidence matters just as much. The organization must be able to show when it applied the fix, what it checked, which credentials it rotated and whether the attacker left persistence behind.

Questions for CISO, IT and E-Commerce Teams

• Which online stores and commerce platforms do we maintain?
• Do we know which Adobe Commerce or Magento Open Source versions we use?
• Is there a clear owner for applying emergency fixes?
• Can we prove that the CVE-2026-75650 hotfix has been applied?
• Do we check for backdoors, hidden files and unusual changes?
• Which keys, passwords and tokens need to be rotated?
• How do we monitor payment integrations and administrator accounts?
• Do we have a response plan if the online store is compromised?
• How do we notify customers, partners and regulators if needed?

The practical takeaway: for an actively exploited vulnerability in an online store, the fix is the beginning. Real protection comes from verification, credential rotation and evidence-based restoration of trust.

Check whether your online store is only updated — or truly protected

DIAMATIX can help assess vulnerabilities, logs, server changes, credentials and incident response readiness for e-commerce environments.

Request an online store security review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Adobe. Security update available for Adobe Commerce — APSB26-146.
• Adobe Commerce. Urgent Action Required: Critical Security Update Available for Adobe Commerce.
• Sansec. StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack.
• BleepingComputer. Adobe fixes critical Magento zero-day exploited to backdoor servers.
• Canadian Centre for Cyber Security. Adobe Security Advisory AV26-888.

This article summarizes publicly available information as of September 2026.