Adobe has released an emergency security fix for CVE-2026-75650, a maximum-severity zero-day vulnerability affecting Adobe Commerce and Magento Open Source that attackers are already exploiting in the wild. The flaw, known as StyleSmuggler, can lead to arbitrary code execution and has been used to install backdoors on vulnerable e-commerce servers.
E-commerce security firm Sansec detected exploitation beginning on at least September 4. The attacks targeted vulnerable Magento installations and deployed malware designed to provide persistent access to compromised online stores, making the vulnerability particularly dangerous for organizations operating internet-facing commerce infrastructure.
Adobe has now confirmed the active exploitation and released the VULN-39341 hotfix. The company assigned the update its highest priority rating and recommends that administrators install it immediately rather than waiting for a normal maintenance cycle.
The vulnerability affects a broad range of products. Adobe Commerce versions 2.4.4 through 2.4.9 are impacted, including August 2026 releases and earlier versions within those branches. Adobe Commerce B2B versions 1.3.3 through 1.5.3 and Magento Open Source versions 2.4.6 through 2.4.9 are also vulnerable.
The scope is notable because systems running recent Adobe security updates may still be exposed. The flaw affects August 2026 releases, meaning organizations that had maintained normal patching schedules could remain vulnerable until the new emergency hotfix is installed.
StyleSmuggler abuses Magento functionality to achieve remote code execution. Earlier analysis from Sansec showed that attackers could hide malicious PHP code inside style-related properties and ultimately cause the application to execute it when processing specific failed-payment functionality.
One indicator associated with the attacks is the appearance of unusual “Payment Transaction Failed Reminder” emails. Attackers can trigger this Magento mechanism as part of the exploitation chain, making unexpected bursts of these messages potentially useful when investigating whether a store has been targeted.
The initial backdoor observed by Sansec attempted to conceal its command-and-control infrastructure by making the remote server resemble an ordinary Network Time Protocol service. This type of camouflage can make malicious communications appear less suspicious during a superficial review of network activity.
The situation has become more serious as additional attackers begin exploiting the vulnerability. Sansec reported observing a second threat actor using unrelated tooling to exploit CVE-2026-75650 and deploy a very small PHP web shell measuring only 485 bytes.
The web shell collects basic information about the compromised server and checks whether Magento’spub/mediadirectory is writable. It then exfiltrates information through requests sent to anoast.sitesubdomain, infrastructure commonly associated with out-of-band interaction testing through tools such as Interactsh.
The appearance of separate attackers is an important development because it suggests knowledge of the vulnerability is spreading beyond the group responsible for the first observed campaign. Once multiple threat actors begin independently exploiting the same zero-day, organizations generally face a much shorter window for remediation.
Installing the hotfix is only part of Adobe’s recommended response. Because the vulnerability has already been actively exploited, the company advises administrators to treat potentially exposed servers as systems where sensitive credentials may have been compromised.
After applying the fix, administrators should enable maintenance mode, suspend cron jobs and rotate secrets associated with the environment. Adobe specifically recommends changing administrator passwords, GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH keys and other API keys.
Once those credentials have been rotated, administrators should flush application caches, restore cron execution and disable maintenance mode. These additional steps are important because patching prevents new exploitation but does not automatically remove persistence or invalidate credentials that an attacker may already have stolen.
Adobe also warns that the emergency hotfix has only been tested against the August 2026 releases of the affected product branches. Although the patch may function with earlier versions, Adobe has not confirmed compatibility across every vulnerable release.
Organizations running older Magento installations may therefore face an additional challenge. They need to close an actively exploited vulnerability quickly while also ensuring that the emergency patch does not introduce compatibility problems into production e-commerce environments.
The active exploitation of StyleSmuggler is particularly concerning because Magento and Adobe Commerce servers can contain valuable business information and credentials. Compromising these systems may expose administrative accounts, databases, customer information, payment integrations and API connections to other corporate services.
Attackers who achieve arbitrary code execution can also use the initial Magento compromise as a starting point for deeper intrusion. Even if the immediate payload is only a small web shell or backdoor, that access can potentially be used to install additional malware, steal credentials, manipulate website content or establish longer-term persistence.
For organizations operating affected Adobe Commerce or Magento deployments, the response should therefore include both remediation and compromise assessment. Administrators should install Adobe’s hotfix immediately, rotate sensitive credentials and investigate systems for suspicious files, processes, failed-payment notifications and unexpected outbound network activity.
The emergence of multiple exploitation campaigns makes CVE-2026-75650 significantly more urgent than a conventional software vulnerability awaiting routine patching. StyleSmuggler is already being weaponized against real online stores, and the availability of an emergency fix means organizations should move quickly to close the vulnerability before additional attackers incorporate it into their operations.