{"id":"CVE-2026-75650","kind":"vulnerability","aliases":["CVE-2026-75650"],"related":[],"title":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…","description":"CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai\n\n# CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento \n\n September 14, 2026 by Akamai Security Intelligence Group \n\n## Key takeaways \n\nWe have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability.\nThe vulnerability carries a maximum CVSS score of 10.0 and requires no authentication or user interaction to exploit. \nAttackers smuggle malicious PHP code into Magento’s template-processing chain via HTTP headers and parameters, later executing it during automated email rendering.\nBased on our investigation, Akamai Adaptive Security Engine (ASE) CMD Injection protections already block the primary GraphQL header- and parameter-based exploitation vectors natively, requiring no new rule deployment. \nWe continue to validate detection coverage across all observed exploitation vectors for this vulnerability.\nAffected customers should still apply Adobe’s official hotfix (APSB26-146/VULN-39341) as soon as possible.\n\n## Vulnerability details \n\nCVE-2026-75650 is a critical remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated attacker to inject PHP code into the platform’s template engine, and later execute it on the server.\n\nThe vulnerability has been actively exploited in the wild since early September 2026, prompting Adobe to release an emergency, out-of-band security update.\n\n### How the StyleSmuggler attack works \n\nThe attack unfolds in four steps:\n\n1. An attacker sends a request to Magento’s GraphQL endpoint with malicious PHP code hidden inside an HTTP header or parameter.\n2. Magento logs the unrecognized value, unintentionally storing the attacker’s PHP code in a server-side log file.\n3. A follow-up request triggers Magento’s template engine, commonly through generating a standard transactional email.\n4. During rendering, the template engine loads the poisoned log file and executes the embedded PHP code, granting the attacker remote code execution.\n\nBecause exploitation requires no authentication nor user interaction, any exposed, unpatched instance is at risk.\n\nThe vulnerability is present in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3. Users should apply the security updates provided by Adobe in APSB26-146 (hotfix VULN-39341) to remediate this vulnerability.\n\n## Mitigation with Akamai App & API Protector \n\nBased on our investigation, Akamai App & API Protector’s Adaptive Security Engine CMD Injection protections natively block the primary GraphQL header- and parameter-based exploitation vectors, without requiring any new rule. Existing ASE rules already detect and stop the PHP/command-injection patterns used in the observed StyleSmuggler exploitation attempts that we analyzed. No public, fully weaponized proof of concept has been observed for this vulnerability as of this writing.\n\nWe continue to validate detection coverage across all observed and emerging exploitation vectors for this vulnerability. While Akamai web application firewall (WAF) protections can identify and block known exploit patterns, the most effective defense continues to be prompt application of the vendor patch. Given this issue’s severity, apply updates as soon as possible.\n\n## Stay tuned","summary":"Adobe Commerce and Magento Open Source fail to neutralize special elements in a template engine, letting an attacker execute arbitrary code on the store server. Sources say it is exploited in the wild, a public proof of concept exists, and attackers are dropping a backdoor.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-08T00:00:00+00:00","products":[{"name":"Adobe Commerce and Magento","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Adobe Commerce","fixed":["Hotfix VULN-39341"],"affected":"2.4.4 to 2.4.9, 2026-aug and earlier","ecosystem":"vendor"},{"name":"Magento Open Source","fixed":["Hotfix VULN-39341"],"affected":"2.4.6 to 2.4.9, 2026-aug and earlier","ecosystem":"vendor"},{"name":"Adobe Commerce B2B","fixed":["Hotfix VULN-39341"],"affected":"1.3.3 to 1.5.3, 2026-aug and earlier","ecosystem":"vendor"},{"name":"adobe commerce","fixed":["2.4.4"],"affected":"< 2.4.4","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.4","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.5","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.8","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.9","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":["1.3.3"],"affected":"< 1.3.3","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.3.3","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.3.4","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.4.2","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.5.2","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.5.3","ecosystem":"vendor"},{"name":"adobe magento","fixed":["2.4.6"],"affected":"< 2.4.6","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.8","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-commerce","akamai","backdoor","exploited","lab-disclosure","magento","poc-public","rce","self-hosted","unauthenticated","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply Adobe hotfix VULN-39341 per APSB26-146 and rotate credentials, following the Adobe KB guidance.","status":"resolved","published_at":"2026-09-07T21:17:30+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T22:41:48+00:00","updated_at":"2026-10-24T18:43:45+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:41:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply Adobe hotfix VULN-39341 per APSB26-146 and rotate credentials, following the Adobe KB guidance.","reach":"internet","title":"Adobe Commerce and Magento: template engine flaw lets attackers run code","impact":"high","summary":"Adobe Commerce and Magento Open Source fail to neutralize special elements in a template engine, letting an attacker execute arbitrary code on the store server. Sources say it is exploited in the wild, a public proof of concept exists, and attackers are dropping a backdoor.","category":"vendor","nicknames":["StyleSmuggler"],"who_cares":["adobe-commerce","magento","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the store server and plants a backdoor.","analyst_note":"Fetch the Sansec StyleSmuggler IOCs and Adobe APSB26-146 KB to get a concrete check for exposure and compromise.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00057,"input_tokens":3612,"output_tokens":418,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Adobe's bulletin for CVE-2026-75650 to get affected and fixed versions, mitigation steps and IOCs; the CISA KEV entry does not list them.","search":"'-146':304C,522C '-2026':19A,22A,144C,156C,191C,313C '-39341':525C '-75650':20A,23A,145C,157C,192C,314C '/vuln-39341':305C '1':391C '1.3.3':508C '1.5.3':510C '10.0':216C '14':167C '2':413C '2.4.4':501C '2.4.9':503C '2026':168C,367C '3':433C '4':451C 'across':286C,611C 'activ':202C,359C 'adapt':255C,545C 'adob':1A,80B,98B,150C,162C,299C,323C,325C,369C,494C,505C,519C 'adobe':25A,29A,34A,37A,39A,41A,43A,45A,47A,49A,51A,54A,57A,60A,63A,66A,69A,71A,73A,75A,77A 'adobe-commerc':79B 'affect':4A,294C,322C 'akamai':82B,154C,170C,196C,254C,532C,540C,622C 'allow':334C 'alreadi':262C,571C 'analyz':587C 'and':27A 'api':534C,542C 'app':533C,541C 'appli':298C,513C,653C 'applic':624C,643C 'apsb26':303C,521C 'arbitrari':117B 'ase':258C,569C 'attack':115B,138B,226C,337C,383C,386C,393C,422C,470C 'attempt':204C,584C 'authent':220C,478C 'autom':247C 'b2b':36A,53A,56A,59A,62A,65A,68A,327C,507C 'backdoor':83B,142B 'band':377C 'base':250C,271C,536C,560C 'block':263C,552C,631C 'carri':210C 'chain':237C 'cmd':259C,548C 'code':118B,184C,230C,319C,341C,405C,425C,467C,472C 'commerc':2A,81B,99B,151C,163C,324C,326C,495C,506C 'commerce':26A,30A,35A,38A,40A,42A,44A,46A,48A,50A,52A,55A,58A,61A,64A,67A 'common':444C 'concept':135B,594C 'confirm':201C 'continu':281C,606C,639C 'coverag':285C,610C 'critic':147C,159C,181C,317C 'custom':295C 'cve':18A,21A,143C,155C,190C,312C 'cvss':213C 'defens':638C 'deploy':279C 'detail':311C 'detect':284C,572C,609C 'disclosur':87B 'drop':140B 'dub':194C 'earli':365C 'effect':637C 'element':11A,108B 'email':248C,450C 'embed':465C 'emerg':373C,615C 'endpoint':401C 'engin':16A,112B,257C,347C,443C,456C,547C 'execut':116B,185C,244C,320C,350C,463C,473C 'exist':136B,568C 'exploit':84B,127B,203C,225C,272C,289C,360C,475C,561C,583C,616C,633C 'expos':483C 'fail':104B 'file':432C,461C 'firewal':625C 'flaw':333C 'follow':436C 'follow-up':435C 'four':389C 'fulli':590C 'generat':446C 'given':648C 'grant':468C 'graphql':266C,400C,555C 'group':173C,199C 'header':240C,267C,410C,556C 'hidden':406C 'host':95B 'hotfix':302C,523C 'http':239C,409C 'identifi':629C 'improp':7A 'inject':260C,339C,549C 'insid':407C 'instanc':485C 'intellig':172C,198C 'interact':223C,481C 'investig':253C,539C 'issu':650C 'key':174C 'known':632C 'lab':86B 'lab-disclosur':85B 'later':243C,349C 'let':113B 'load':457C 'log':415C,431C,460C 'magento':28A,31A,70A,72A,74A,76A,78A,88B,101B,153C,165C,232C,329C,398C,414C,440C,497C 'malici':228C,403C 'maximum':212C 'mitig':530C 'nativ':274C,551C 'neutral':8A,106B 'new':277C,566C 'observ':288C,581C,597C,613C 'offici':301C 'open':32A,102B,330C,498C 'out-of-band':374C 'paramet':242C,270C,412C,559C 'parameter-bas':269C,558C 'patch':647C 'pattern':577C,634C 'php':229C,340C,404C,424C,466C 'php/command-injection':576C 'platform':344C 'poc':90B 'poc-publ':89B 'poison':459C 'possibl':309C,658C 'present':492C 'primari':265C,554C 'process':236C 'prompt':368C,642C 'proof':133B,592C 'protect':261C,550C,627C 'protector':535C,543C 'provid':517C 'public':91B,132B,589C 'rce':92B,148C,160C,186C 'releas':371C 'remedi':527C 'remot':183C,318C,471C 'render':249C,453C 'request':396C,438C 'requir':218C,275C,476C,564C 'risk':488C 'rule':278C,567C,570C 'say':124B 'score':214C 'secur':171C,197C,256C,378C,515C,546C 'self':94B 'self-host':93B 'send':394C 'septemb':166C,366C 'server':122B,354C,429C 'server-sid':428C 'sever':652C 'side':430C 'sinc':364C 'smuggl':227C 'soon':307C,656C 'sourc':103B,123B,331C,499C 'source':33A 'special':10A,107B 'standard':448C 'stay':659C 'step':390C 'still':297C 'stop':574C 'store':121B,420C 'stylesmuggl':146C,158C,195C,382C,582C 'stylesmuggler':24A 'takeaway':175C 'templat':15A,111B,235C,346C,442C,455C 'template-process':234C 'track':179C,188C 'transact':449C 'trigger':439C 'tune':660C 'unauthent':96B,182C,336C 'unfold':387C 'unintent':419C 'unpatch':484C 'unrecogn':417C 'updat':379C,516C,654C 'use':12A,578C 'user':222C,480C,511C 'valid':283C,608C 'valu':418C 'vector':273C,290C,562C,617C 'vendor':97B,646C 'version':500C 'via':238C 'vuln':524C 'vulner':17A,187C,207C,209C,293C,310C,321C,356C,490C,529C,600C,620C 'waf':626C 'weapon':591C 'web':623C 'wild':130B,363C 'without':563C 'work':384C 'write':604C","nicknames":["StyleSmuggler"],"mitigations":[{"kind":"waf-rule","scope":null,"since":null,"covers":"Primary GraphQL header- and parameter-based exploitation vectors for CVE-2026-75650, blocked natively by Akamai ASE CMD Injection protections without a new rule","limits":"Akamai is still validating detection coverage across all observed and emerging exploitation vectors; WAF protections identify only known exploit patterns","source":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento","vendor":"Akamai","seen_at":"2026-10-24T18:43:34Z","confidence":0.8,"source_title":"CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai","customer_action":"Apply Adobe's hotfix APSB26-146 (VULN-39341) as soon as possible, since the WAF protection is not a substitute for the vendor patch"},{"kind":"waf-rule","since":"2026-09-10","covers":"HTTP requests proxied through Cloudflare matching the Adobe Commerce Remote Code Execution detection (Cloudflare Managed Ruleset rule ...440f5c55), action Block","limits":"origin applications not yet patched remain vulnerable to traffic that bypasses Cloudflare; does not remediate an existing compromise","source":"https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:09Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-09-10 - Emergency · Changelog","customer_action":"apply the Adobe hotfix in APSB26-146, update origin applications, and rotate encryption keys, integration tokens and system credentials"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-07T21:17:30+00:00","kev":{"dateAdded":"2026-09-08","dueDate":"2026-09-11","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-75650","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650","severity":null,"published_at":"2026-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-75650:122","url":null,"severity":null,"published_at":"2026-10-23T21:39:21+00:00","modified_at":"2026-10-23T21:39:21+00:00","first_seen_at":"2026-10-23T21:39:21+00:00","fetched_at":"2026-10-23T21:39:21+00:00","note":"Adobe APSB26-146 (Sep 7 2026, priority 1, CVSS 10.0 unauth RCE, 'StyleSmuggler'); exploited since Sep 4 per Sansec; public PoC (fortbridge); hotfix VULN-39341 + credential rotation per Adobe KB. Severity raised from high to critical: vendor CVSS 10.0, exploited, public PoC. No social search done."},{"source":"nvd","external_id":"CVE-2026-75650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75650","severity":null,"published_at":"2026-09-07T21:17:30+00:00","modified_at":"2026-09-09T05:18:07+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento#CVE-2026-75650","url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento","severity":null,"published_at":"2026-09-14T12:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Akamai: CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai"}],"documents":[{"id":1169,"url":"https://www.adobe.com/trust/security/products/commerce/apsb26-146.html","title":"Adobe APSB26-146","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1170,"url":"https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146","title":"Adobe KB: APSB26-146 hotfix and credential rotation","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1171,"url":"https://sansec.io/research/stylesmuggler-0day","title":"Sansec: StyleSmuggler 0-day (IOCs)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1172,"url":"https://kitploit.com/en/tools/github/fortbridge/stylesmuggler","title":"fortbridge/stylesmuggler PoC","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1173,"url":"https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/","title":"BleepingComputer: Adobe fixes Magento zero-day","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2850,"url":"https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-09-10 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-09-10 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 10, 2026\n\n## WAF Release - 2026-09-10 - Emergency\n\nThis update provides immediate defense against a high-severity, actively exploited zero-day vulnerability targeting Adobe Commerce and Magento Open Source storefronts.\n\nKey Findings\n\n- Adobe Commerce and Magento RCE (CVE-2026-75650 / \"StyleSmuggler\"): Unauthenticated Remote Code Execution (RCE) vulnerability caused by improper neutralization of special elements in the platform's template engine. Unauthenticated attackers can inject arbitrary PHP payloads through style properties to execute system commands and deploy persistent malware.\n\nImpact\n\nThis emergency rule provides immediate edge-level mitigation and virtual patching, origin applications must be urgently updated. We strongly recommend to apply the hotfix outlined in Adobe Security Bulletin APSB26-146 and immediately rotate all potentially exposed encryption keys, integration tokens, and system credentials, as patching alone does not remediate an existing compromise.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...440f5c55 | N/A | Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650 | N/A | Block | This is a new detection. |","published_at":"2026-09-10T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2893,"url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento","title":"Akamai: CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai","kind":"advisory","source":"lab","text":"CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai\n\n# CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento \n\n September 14, 2026 by Akamai Security Intelligence Group \n\n## Key takeaways \n\nWe have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability.\nThe vulnerability carries a maximum CVSS score of 10.0 and requires no authentication or user interaction to exploit. \nAttackers smuggle malicious PHP code into Magento’s template-processing chain via HTTP headers and parameters, later executing it during automated email rendering.\nBased on our investigation, Akamai Adaptive Security Engine (ASE) CMD Injection protections already block the primary GraphQL header- and parameter-based exploitation vectors natively, requiring no new rule deployment. \nWe continue to validate detection coverage across all observed exploitation vectors for this vulnerability.\nAffected customers should still apply Adobe’s official hotfix (APSB26-146/VULN-39341) as soon as possible.\n\n## Vulnerability details \n\nCVE-2026-75650 is a critical remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated attacker to inject PHP code into the platform’s template engine, and later execute it on the server.\n\nThe vulnerability has been actively exploited in the wild since early September 2026, prompting Adobe to release an emergency, out-of-band security update.\n\n### How the StyleSmuggler attack works \n\nThe attack unfolds in four steps:\n\n1. An attacker sends a request to Magento’s GraphQL endpoint with malicious PHP code hidden inside an HTTP header or parameter.\n2. Magento logs the unrecognized value, unintentionally storing the attacker’s PHP code in a server-side log file.\n3. A follow-up request triggers Magento’s template engine, commonly through generating a standard transactional email.\n4. During rendering, the template engine loads the poisoned log file and executes the embedded PHP code, granting the attacker remote code execution.\n\nBecause exploitation requires no authentication nor user interaction, any exposed, unpatched instance is at risk.\n\nThe vulnerability is present in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3. Users should apply the security updates provided by Adobe in APSB26-146 (hotfix VULN-39341) to remediate this vulnerability.\n\n## Mitigation with Akamai App & API Protector \n\nBased on our investigation, Akamai App & API Protector’s Adaptive Security Engine CMD Injection protections natively block the primary GraphQL header- and parameter-based exploitation vectors, without requiring any new rule. Existing ASE rules already detect and stop the PHP/command-injection patterns used in the observed StyleSmuggler exploitation attempts that we analyzed. No public, fully weaponized proof of concept has been observed for this vulnerability as of this writing.\n\nWe continue to validate detection coverage across all observed and emerging exploitation vectors for this vulnerability. While Akamai web application firewall (WAF) protections can identify and block known exploit patterns, the most effective defense continues to be prompt application of the vendor patch. Given this issue’s severity, apply updates as soon as possible.\n\n## Stay tuned","published_at":"2026-09-14T12:00:00+00:00","relation":"advisory","confidence":null,"note":"Akamai disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}