BREAKING: CVE-2026-75650 lets unauth callers run code on Adobe Commerce and Magento

If you run Adobe Commerce or Magento Open Source with GraphQL reachable, an unauthenticated caller can smuggle PHP into Magento's template engine through styles properties and get that code executed when Magento renders its own "Payment Transaction Failed Reminder" email. Adobe published APSB26-146 today (Priority 1) for CVE-2026-75650, scored CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C), and states the bug is already exploited in the wild. The fix is the VULN-39341 composer hotfix, not a full minor release. Sansec tracked the same chain as StyleSmuggler with confirmed exploitation since September 4, three days before the Adobe bulletin.

This is the operator write-up. The HOL Guard evidence pack for CVE-2026-75650 is the source record.

What breaks

Adobe's CVE text is short: improper neutralization of special elements used in a template engine (CWE-1336) that can yield arbitrary code execution in the context of the current user, without user interaction, with changed scope. The bulletin lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier on those trains, Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier, and Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier. Authentication required to exploit: No.

Sansec's public StyleSmuggler write-up fills in the mechanism Adobe's advisory does not spell out. Attackers plant malicious PHP into a file Magento itself writes (for example a payment-failure report) by stuffing hostile content into GraphQL styles properties that skip existing sanitization. A second stage deliberately triggers Magento's standard Payment Transaction Failed Reminder email. The poisoned code runs while Magento renders that message server-side, so nobody has to open or receive the email. Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9, and reported a victim on 2.4.6-p15 with July and August 2026 security patches applied and security:patch-status clean. Patch train currency was not a defense before VULN-39341.

Post-exploitation payloads Sansec published include Rust implants that rename themselves across [kworker/...], fc-cache, and chronyd, plus PHP droppers and web shells under pub/media. A second, unrelated actor was already dropping PHP webshells on September 7. Treat any store that was internet-facing between September 4 and hotfix application as compromise-suspect until scanned.

Who is not in scope

• Stores that are not Adobe Commerce / Magento Open Source (or Commerce B2B). WooCommerce, Shopify, BigCommerce, and custom storefronts are outside this CVE.
• Magento 1.x / Adobe Commerce 1.x. Affected trains in APSB26-146 are the 2.4.x (and B2B 1.3–1.5) lines listed above.
• Merchants who already applied Adobe's VULN-39341 hotfix and completed the encryption-key plus credential rotation checklist in the Experience League article. Hotfix alone closes the hole; rotation is required for full remediation if secrets may have been read.
• Headless frontends are not a free pass. Sansec notes Redis/DB session moves and classic vs Hyvä storefront choices do not stop the GraphQL/template path. If GraphQL is reachable on an affected Magento backend, you are in scope until patched.

What this is not

This is not a browser XSS bug and it is not "only" email phishing. It is unauthenticated remote code execution on the Magento/Adobe Commerce application process via template injection, confirmed by Adobe as exploited in the wild. It is also not fixed by upgrading to 2.4.9 alone: Adobe's affected table includes 2.4.9-2026-aug and earlier until the hotfix is applied.

How to fix

Lead with Adobe's Priority 1 path:

1. Download VULN-39341-composer-patches.zip from repo.magento.com (Adobe Commerce credentials required).
2. Unzip and apply the composer patch per Adobe's "How to apply a composer patch provided by Adobe" KB. The patch file name in Adobe's example is VULN-39341_Hotfix_COMPOSER.patch.
3. Adobe tested the hotfix on the 2026-aug builds of Commerce 2.4.4–2.4.9, Magento Open Source 2.4.6–2.4.9, and B2B 1.3.3–1.5.3. Older builds on those branches are still listed as affected; Adobe says the patch is unverified there.
4. Rotate credentials after the patch. Adobe's Experience League article is explicit: rotating the encryption key alone does not invalidate anything an attacker already read. Rotate admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment gateway API credentials at the provider, database credentials, SSH/deploy keys, and third-party extension API keys at their source.
5. Scan for compromise before you declare the store clean. Patching does not remove implants dropped between September 4 and hotfix day.

Operator check (Adobe Commerce on Cloud / Quality Patches Tool path Adobe documents):

# After installing the Quality Patches Tool and placing the hotfix:
vendor/bin/magento-patches -n status | grep "39341\|Status"
# Expect VULN-39341 / …/m2-hotfixes/VULN-39341_Hotfix_COMPOSER.patch → Applied

# Host IOCs Sansec published for StyleSmuggler implants (run on the Magento host):
ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd'
ls -la ~/.cache/fontconfig/fc-cache /tmp/.fc-*/fc-cache /tmp/.chrony-*/chronyd 2>/dev/null
grep -ril 'x_trace_' var/report/ || true

If you cannot patch immediately and you do not need GraphQL for a headless or PWA storefront, Sansec's interim guidance was to disable GraphQL until the official fix landed. Prefer the Adobe hotfix now that APSB26-146 exists; do not treat GraphQL disable as a substitute for VULN-39341 plus credential rotation and a malware scan.

References

• Adobe APSB26-146
• Adobe Experience League: apply hotfix + rotate credentials
• VULN-39341-composer-patches.zip
• Sansec: StyleSmuggler (CVE-2026-75650)
• CVE-2026-75650 record