Summary

StyleSmuggler, with the CVE identifier CVE-2026-75650 and the highest CVSS score of 10, is an unauthenticated remote code execution (RCE) zero-day vulnerability actively exploited in the wild against Magento Open Source and Adobe Commerce. Discovered by Sansec, the vulnerability affects every version from 2.4.4 up to and including 2.4.9. Successful exploitation allows attackers to inject malicious PHP code into Magento's template system, which is then executed during the rendering of a "Payment Transaction Failed Reminder" email. Exploitation has been observed in the wild; attackers began leveraging this flaw on September 4 to deploy Linux backdoors on vulnerable instances.

Affected Systems and Applications

Technical Details

The StyleSmuggler exploit operates in two distinct stages:

1. Injection (Poisoning): The attacker injects malicious PHP code into a file that Magento writes, such as system logs or failure reports.
2. Execution: The attacker deliberately triggers Magento's standard "Payment Transaction Failed Reminder" email. During the email template rendering process, Magento executes the poisoned code. The exploit specifically targets Magento's dependency-injection code scanner classes, redirecting them to execute the poisoned log or report file.

The attack succeeds even when email delivery fails, as the critical code execution occurs during the template rendering phase.

Post-Exploitation: Rust-Based Backdoor

Mitigation

• Apply Adobe Hotfix: Deploy Adobe's VULN-39341 hotfix for CVE-2026-75650. Patching does not clean a compromised store.
• Disable GraphQL: Temporarily disable GraphQL as an interim mitigation measure until patches are fully applied
• Block Dropper Execution: Add proc_open to PHP's disable_functions directive
• Mount Restrictions: Mount /tmp, /var/tmp, and /dev/shm with the noexec flag to prevent execution of dropped binaries

Compromise Response

If compromise is confirmed, the following remediation steps are recommended:

1. Flush session storage (including Redis if used).
2. Rotate the Magento encryption key.
3. Reset all credentials protected by the encryption key. From Sansec: "Rotate those at the source, not only inside Magento. Rotating the encryption key on its own does not invalidate anything an attacker already read."
   • Admin passwords
   • REST / SOAP / GraphQL integration tokens
   • OAuth client secrets
   • Payment gateway API credentials
   • Database credentials
   • SSH and deploy keys
   • Third-party extension API keys

Indicators of Compromise - from Sansec

More detailed indicators are available in Sansec's article, also linked in References below.

# malware download
https://www.incofar.it/js/jquery/plugins/ajaxfileupload/mag.txt
247.cdnflare.xyz                  malware download host
209.141.43.95                     malware download host

# C2 servers
99.84.67.186:443                  C2, WebSocket over TLS
windwsecurity.run:443             remote shell, WebSocket over TLS (TCP)
ntp.timesync.net:123              C2, custom NTP-shaped traffic (UDP)
time.microsft.run:123             C2, custom NTP-shaped traffic (UDP)
pool.microsft.studio:123          C2, custom NTP-shaped traffic (UDP)
ntp.timesync.to:123               C2, custom NTP-shaped traffic (UDP), fc-cache build
185.157.160.251:123               C2, A record for ntp.timesync.to and ntp.timesync.net on 2026-09-07
ntp.synctime.to:123               C2, fallback
ntp.syncstime.to:123              C2, fallback

# attacker sources
88.216.72.181                     attacker source, seen at multiple victims
182.182.152.48                    attacker source
76.31.99.207                      attacker source, failed exploit attempt
209.73.130.148                    attacker source, successful exploit attempt
77.239.124.107                    attacker source, follow-up requests

sha256  e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7
sha256  b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420
sha256  4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e  kworker x64 variant
sha256  d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82  kworker ARM variant
sha256  1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d  chronyd variant

What the Cyber Fusion Center is Doing

The CFC is actively monitoring threat intelligence and reports related to StyleSmuggler/CVE-2026-75650. This advisory will be updated if required.

References

• StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack — Sansec
• Magento StyleSmuggler zero-day exploited to deploy Linux backdoor — BleepingComputer
• StyleSmuggler: Magento / Adobe Commerce 0day — SOCRadar
• Adobe Security Bulletin APSB26-146
• Security update for Adobe Commerce - APSB26-146

‍