StyleSmuggler: unauthenticated Adobe Commerce RCE triggers on failed payment email rendering

What happened

A critical, unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source is being exploited in the wild, according to research from security firm Sansec. Tracked as CVE-2026-75650 and nicknamed StyleSmuggler, the flaw lets an attacker run arbitrary code on a vulnerable storefront without any credentials. Adobe has shipped a hotfix under bulletin APSB26-146. Sansec published its findings on September 5, 2026, a detailed technical writeup circulated on dev.to, and BleepingComputer also reported on the active exploitation.

How the attack works

The exploit begins with a crafted request sent to a vulnerable storefront. According to the Sansec analysis, the attacker abuses the platform's template processing, including style-related properties, to smuggle PHP code into content such as a template or a payment failure report. The injected code executes when the server renders a failed payment email.

Two details make this especially effective. No one has to open the email, because execution happens during server-side rendering. And successful email delivery is not required at all, so mail filtering or blocked messages do not neutralize the attack.

What has been observed

In the incidents Sansec investigated, the resulting code execution deployed a Rust-based backdoor for Linux. Other observed payloads include PHP web shells, though the analysis cautions that these should not automatically be attributed to the same actor.

The backdoor's behavior varies between variants. Depending on the version, it communicates with its command-and-control infrastructure over WebSocket wrapped in TLS, or through NTP-like traffic on UDP port 123. Later variants reportedly send bursts of nine 48-byte datagrams roughly once a minute, which the writeup frames as a hunting clue rather than a standalone verdict. Persistence also varies: some installations rely on cron, while others relaunch without any cron entry. Some variants disguise themselves with process names such as [kworker/u:8:0], fc-cache or chronyd.

Sansec described the backdoor transmitting host and system information, but the analysis distinguishes this from proof that customer or payment data was stolen.

Detection and caveats

For administrators, the relevant evidence includes altered templates or failure reports, unauthorized PHP files under pub/media, unexpected processes, and new or modified cron entries. Store operators may notice sudden bursts of failed payment notifications, but the analysis stresses this is an investigation lead, not proof of compromise, since legitimate payment failures produce the same signal.

Several cautions accompany these indicators. Email opens are irrelevant to triggering this RCE. A parent PID of 1 does not by itself reveal how a process is being relaunched. Investigators should not indiscriminately delete PHP files or cron jobs, or treat all NTP traffic as malicious. And the initial execution occurs in the web application's process context, which should not be described as root access without supporting evidence.

Patching and recovery

Adobe's fix is hotfix VULN-39341, and Adobe advises following its version-specific guidance because the hotfix's tested compatibility range is not identical to every version described as vulnerable, which include Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Administrators should verify the hotfix actually installed.

Crucially, applying the hotfix does not remove malware already on the server or invalidate credentials exposed during a compromise. The recommended sequence is to preserve evidence and investigate for existing compromise before treating an installation as clean, remove confirmed malicious files and persistence mechanisms, block identified malicious destinations, and follow Adobe's credential-rotation procedure, including encryption-key rotation. Blocking outbound traffic may disrupt the backdoor, but it will not prevent the initial server-side code execution.

Why it matters

StyleSmuggler combines the worst properties of an e-commerce vulnerability: it is unauthenticated, remotely reachable, requires zero interaction from any victim, and is already being exploited alongside a capable backdoor. Adobe Commerce and Magento power a large share of online retail, and a compromised storefront process can potentially reach customer, order, payment and secret material. Patching alone is not the end of the response. Operators must assume the fix does not evict an attacker who arrived first, so compromise investigation and credential rotation belong in the same urgent task list as the hotfix itself.