---
id: "CVE-2026-75650"
kind: "vulnerability"
aliases: ["CVE-2026-75650"]
title: "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "resolved"
category: "vendor"
products: [{"name": "Adobe Commerce and Magento", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Adobe Commerce", "fixed": ["Hotfix VULN-39341"], "affected": "2.4.4 to 2.4.9, 2026-aug and earlier", "ecosystem": "vendor"}, {"name": "Magento Open Source", "fixed": ["Hotfix VULN-39341"], "affected": "2.4.6 to 2.4.9, 2026-aug and earlier", "ecosystem": "vendor"}, {"name": "Adobe Commerce B2B", "fixed": ["Hotfix VULN-39341"], "affected": "1.3.3 to 1.5.3, 2026-aug and earlier", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": ["2.4.4"], "affected": "< 2.4.4", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.4", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.5", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.6", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.7", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.8", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.9", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": ["1.3.3"], "affected": "< 1.3.3", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.3.3", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.3.4", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.4.2", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.5.2", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.5.3", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": ["2.4.6"], "affected": "< 2.4.6", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.6", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.7", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.8", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-commerce", "akamai", "backdoor", "exploited", "lab-disclosure", "magento", "poc-public", "rce", "self-hosted", "unauthenticated", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2026-09-07T21:17:30+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T18:43:45+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:39:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "lab", "url": "https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento", "first_seen_at": "2026-10-24T18:43:45+00:00"}]
---

# Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…

Adobe Commerce and Magento Open Source fail to neutralize special elements in a template engine, letting an attacker execute arbitrary code on the store server. Sources say it is exploited in the wild, a public proof of concept exists, and attackers are dropping a backdoor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Commerce and Magento affected ? fixed ?
- vendor:Adobe Commerce affected 2.4.4 to 2.4.9, 2026-aug and earlier fixed Hotfix VULN-39341
- vendor:Magento Open Source affected 2.4.6 to 2.4.9, 2026-aug and earlier fixed Hotfix VULN-39341
- vendor:Adobe Commerce B2B affected 1.3.3 to 1.5.3, 2026-aug and earlier fixed Hotfix VULN-39341
- vendor:adobe commerce affected < 2.4.4 fixed 2.4.4
- vendor:adobe commerce affected = 2.4.4 fixed ?
- vendor:adobe commerce affected = 2.4.5 fixed ?
- vendor:adobe commerce affected = 2.4.6 fixed ?
- vendor:adobe commerce affected = 2.4.7 fixed ?
- vendor:adobe commerce affected = 2.4.8 fixed ?
- vendor:adobe commerce affected = 2.4.9 fixed ?
- vendor:adobe commerce b2b affected < 1.3.3 fixed 1.3.3
- vendor:adobe commerce b2b affected = 1.3.3 fixed ?
- vendor:adobe commerce b2b affected = 1.3.4 fixed ?
- vendor:adobe commerce b2b affected = 1.4.2 fixed ?
- vendor:adobe commerce b2b affected = 1.5.2 fixed ?
- vendor:adobe commerce b2b affected = 1.5.3 fixed ?
- vendor:adobe magento affected < 2.4.6 fixed 2.4.6
- vendor:adobe magento affected = 2.4.6 fixed ?
- vendor:adobe magento affected = 2.4.7 fixed ?
- vendor:adobe magento affected = 2.4.8 fixed ?
- vendor:adobe magento affected = 2.4.9 fixed ?

## Fix

Apply Adobe hotfix VULN-39341 per APSB26-146 and rotate credentials, following the Adobe KB guidance.

## Mitigated for you by

- Akamai (waf-rule): covers Primary GraphQL header- and parameter-based exploitation vectors for CVE-2026-75650, blocked natively by Akamai ASE CMD Injection protections without a new rule Limits: Akamai is still validating detection coverage across all observed and emerging exploitation vectors; WAF protections identify only known exploit patterns Still: Apply Adobe's hotfix APSB26-146 (VULN-39341) as soon as possible, since the WAF protection is not a substitute for the vendor patch https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento
- Cloudflare (waf-rule, since 2026-09-10): covers HTTP requests proxied through Cloudflare matching the Adobe Commerce Remote Code Execution detection (Cloudflare Managed Ruleset rule ...440f5c55), action Block Limits: origin applications not yet patched remain vulnerable to traffic that bypasses Cloudflare; does not remediate an existing compromise Still: apply the Adobe hotfix in APSB26-146, update origin applications, and rotate encryption keys, integration tokens and system credentials https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650
- 2026-10-23T21:39:21+00:00 analyst — Adobe APSB26-146 (Sep 7 2026, priority 1, CVSS 10.0 unauth RCE, 'StyleSmuggler'); exploited since Sep 4 per Sansec; public PoC (fortbridge); hotfix VULN-39341 + credential rotation per Adobe KB. Severity raised from high to critical: vendor CVSS 10.0, exploited, public PoC. No social search done.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75650
- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento — Akamai: CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai

## Documents

- [advisory] Adobe APSB26-146 https://www.adobe.com/trust/security/products/commerce/apsb26-146.html
- [advisory] Cloudflare: WAF Release - 2026-09-10 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/
- [advisory] Akamai: CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento
- [describes] Sansec: StyleSmuggler 0-day (IOCs) https://sansec.io/research/stylesmuggler-0day
- [describes] BleepingComputer: Adobe fixes Magento zero-day https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
- [fix] Adobe KB: APSB26-146 hotfix and credential rotation https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
- [poc] fortbridge/stylesmuggler PoC https://kitploit.com/en/tools/github/fortbridge/stylesmuggler

## From the sources

CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai

# CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento 

 September 14, 2026 by Akamai Security Intelligence Group 

## Key takeaways 

We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability.
The vulnerability carries a maximum CVSS score of 10.0 and requires no authentication or user interaction to exploit. 
Attackers smuggle malicious PHP code into Magento’s template-processing chain via HTTP headers and parameters, later executing it during automated email rendering.
Based on our investigation, Akamai Adaptive Security Engine (ASE) CMD Injection protections already block the primary GraphQL header- and parameter-based exploitation vectors natively, requiring no new rule deployment. 
We continue to validate detection coverage across all observed exploitation vectors for this vulnerability.
Affected customers should still apply Adobe’s official hotfix (APSB26-146/VULN-39341) as soon as possible.

## Vulnerability details 

CVE-2026-75650 is a critical remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated attacker to inject PHP code into the platform’s template engine, and later execute it on the server.

The vulnerability has been actively exploited in the wild since early September 2026, prompting Adobe to release an emergency, out-of-band security update.

### How the StyleSmuggler attack works 

The attack unfolds in four steps:

1. An attacker sends a request to Magento’s GraphQL endpoint with malicious PHP code hidden inside an HTTP header or parameter.
2. Magento logs the unrecognized value, unintentionally storing the attacker’s PHP code in a server-side log file.
3. A follow-up request triggers Magento’s template engine, commonly through generating a standard transactional email.
4. During rendering, the template engine loads the poisoned log file and executes the embedded PHP code, granting the attacker remote code execution.

Because exploitation requires no authentication nor user interaction, any exposed, unpatched instance is at risk.

The vulnerability is present in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3. Users should apply the security updates provided by Adobe in APSB26-146 (hotfix VULN-39341) to remediate this vulnerability.

## Mitigation with Akamai App & API Protector 

Based on our investigation, Akamai App & API Protector’s Adaptive Security Engine CMD Injection protections natively block the primary GraphQL header- and parameter-based exploitation vectors, without requiring any new rule. Existing ASE rules already detect and stop the PHP/command-injection patterns used in the observed StyleSmuggler exploitation attempts that we analyzed. No public, fully weaponized proof of concept has been observed for this vulnerability as of this writing.

We continue to validate detection coverage across all observed and emerging exploitation vectors for this vulnerability. While Akamai web application firewall (WAF) protections can identify and block known exploit patterns, the most effective defense continues to be prompt application of the vendor patch. Given this issue’s severity, apply updates as soon as possible.

## Stay tuned

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_