Magento StyleSmuggler flaw turns payment failure emails into unauthenticated RCE

What happened

Attackers have been compromising Adobe Commerce and Magento Open Source storefronts through a template injection flaw that converts a routine payment failure email into unauthenticated remote code execution. Tracked as CVE-2026-75650 and named StyleSmuggler by the Dutch ecommerce security firm Sansec, the bug sits in Magento's template rendering and has been exploited since 4 September 2026, according to a technical write-up on dev.to. Adobe's advisory APSB26-146 rates the flaw 10.0 on the CVSS scale, while NVD records 9.8; the two sources disagree, and both figures are reported here without reconciliation. The weakness is classified as CWE-1336, improper neutralization of special elements used in a template engine.

How the attack works

The exploit begins by planting PHP code inside data that Magento itself generates, such as the contents of a failed payment report. The attacker then triggers the standard "Payment Transaction Failed Reminder" email. When Magento renders that template it resolves a style attribute, and, as the write-up describes, nothing in the pipeline stops that attribute from carrying executable code. The injected code then runs with the permissions of the web server process.

Two details make the bug unusually severe. No administrator account is required, and no victim has to click anything. According to the reporting, the attack completes even if the email is never delivered.

Backdoor and persistence

The primary post-exploitation payload is a small backdoor written in Rust. It hides behind process names such as [kworker/u:8:0], fc-cache and chronyd so that it blends into an ordinary process listing. Its command-and-control traffic imitates NTP time synchronization over UDP port 123, traffic that rarely draws scrutiny. Some variants copy themselves into the fontconfig cache directory and register a scheduled task that relaunches them twice an hour, so a reboot does not evict them. A separate, smaller PHP web shell has also been observed in the product image cache directory.

Affected versions

Adobe's advisory lists the following as affected, including installations that had already applied the August 2026 monthly patches:

• Adobe Commerce 2.4.4 through 2.4.9, including the -2026-aug releases and earlier
• Adobe Commerce B2B 1.3.3 through 1.5.3, including -2026-aug and earlier
• Magento Open Source 2.4.6 through 2.4.9, including -2026-aug and earlier

Sansec's first confirmed victim was running 2.4.6-p15, the newest release at the time, and the store had passed a security status check before compromise.

Timeline and exploitation status

Sansec observed exploitation beginning 4 September 2026. Adobe shipped hotfix VULN-39341 on 7 September, leaving a three-day window in which attackers operated against unpatched stores. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 8 September, with a federal remediation deadline of 11 September and a requirement for forensic investigation. On 7 September, the same day the fix arrived, Sansec saw a second, unrelated attacker abuse the same flaw to drop a 485-byte PHP web shell, meaning a single compromised store can host intruders who are unaware of each other.

Remediation and detection

Merchants should apply hotfix VULN-39341 for their version; Adobe-hosted stores received the update through the managed pipeline. Versions 2.4.0 through 2.4.3 are end-of-life, and Scandiweb published a backport that Adobe has not validated, so it needs staging verification before production use.

Patching closes the door but removes no one who has already walked through it. Adobe requires rotating the encryption key and all credentials, and the order matters: the encryption key comes first because it protects downstream secrets, followed by administrator passwords, REST, SOAP and GraphQL tokens, payment gateway API credentials, database accounts and SSH keys.

For detection, the write-up advises reviewing the pub/media directory for PHP files that should not be there, auditing processes and scheduled tasks, and checking for outbound traffic on UDP port 123. Sansec and other vendors, including eComscan, have released scanning tools that look for the Rust backdoor and secondary web shells.

Why it matters

StyleSmuggler is a reminder that a clean security scan is not proof of safety: the first known victim was fully patched and had passed a status check. It also shows how an unglamorous transactional feature, an email most merchants never think about, can become the weakest link in an ecommerce stack, and how a single published flaw lets multiple attacker groups pile into the same store independently. With CISA requiring remediation within days, the practical takeaway for any Magento operator is unchanged: patch, rotate keys in the correct order, and hunt for persistence rather than assuming a rebuild ends the incident.