Adobe published APSB26-146 on September 7, 2026, fixing CVE-2026-75650, a critical unauthenticated remote-code-execution flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that security researcher Sansec has nicknamed "StyleSmuggler." The bug carries the maximum CVSS score of 10.0. CISA added it to its Known Exploited Vulnerabilities catalog on September 8 with a federal remediation deadline of September 11, which has now passed.
Photo: Shixart1985 (CC BY 2.0), Wikimedia Commons.
What's affected and what's happening
The flaw affects Commerce and Magento Open Source versions 2.4.4 through 2.4.9, including all patch releases up to and including the August 2026 monthly release, plus Commerce B2B 1.3.3 through 1.5.3. Sansec reported the first confirmed exploitation on September 4, before Adobe's patch shipped, and has published indicators of compromise including unexpected "Payment Transaction Failed" notification bursts, processes disguised as fc-cache, chronyd or kworker, unfamiliar cron entries, and unexpected PHP files under pub/media.
Why the hotfix alone is not remediation
Applying hotfix VULN-39341 closes the code-execution path, but Adobe's own guidance is explicit that it does not undo any exposure that already happened. The vulnerable template engine sits near the encryption key that protects integration tokens, payment-gateway credentials, and system-privileged automation tokens. If an attacker reached that key before the hotfix was applied, rotating the key — and every credential it could have exposed — is the only way to close the loop.
What a full remediation looks like
Confirm hotfix VULN-39341 is actually applied — a version string alone does not prove it.
Rotate the encryption key, following Adobe's Experience League rotation procedure.
Rotate admin, integration, OAuth, payment, database, SSH and extension credentials that key may have protected.
Review server cron jobs and running processes for the indicators Sansec has published.
Re-attest completion once rotation is verified, not just once the hotfix is installed.
Given active exploitation before the patch existed, any merchant that patched late should assume compromise is possible until the log review says otherwise.
In 5 minutes, check whether your SME or MSP falls under NIS2 and score your readiness on risk management and incident reporting. Free, stays in your browser.
We use technical cookies to keep the site running. With your consent we also use analytics and marketing cookies to improve the product. You can change your mind at any time.
01
NecessaryAlways on
Required for the site to work (login, preferences, security). Always on.
02
Help us understand how the site is used, in aggregate and anonymous form.
03
Let us measure how well our campaigns perform. Off by default.
