Adobe Patches a Perfect-10 Flaw in Commerce's Template Engine

Adobe shipped an out-of-band hotfix on Sept. 7, 2026, for a template-engine flaw in Commerce that carries a perfect 10.0 score on the CVSS severity scale, three days after security firm Sansec caught it being used against live stores. Adobe's advisory, APSB26-146, confirms the flaw, tracked as CVE-2026-75650, was already being exploited when the fix went out.

The score is defensible rather than inflated. The vector string, AV:N/AC:L/PR:N/UI:N/S:C, means an attacker needs no account on the store, no interaction from a victim and no special network position, and the scope is marked changed because a successful attack reaches beyond the vulnerable component. Sansec, which named the exploit StyleSmuggler, said it first confirmed exploitation at 22:20 UTC on Sept. 4, then reproduced the attack on a clean installation the next day.

How StyleSmuggler gets code onto the server

Satnam Narang, senior staff research engineer at Tenable's Security Response team, wrote that the bug is a flaw in how Magento's template engine processes style-related properties. An attacker smuggles PHP code in through those properties, and the code is written to disk without needing a login. It runs the next time the store renders a transactional email, specifically the "Payment Transaction Failed Reminder" notification that Magento generates automatically.

Narang's writeup also documents what the malware does once it is running: it installs itself at a path under the store's home directory, disguises its process under names including a fake kernel worker thread and the legitimate utilities fc-cache and chronyd, and restarts itself by cron every five minutes in early samples, every 30 minutes in later ones. Built binaries support both x86-64 and arm64 hosts, meaning the campaign was not written for one hosting provider's hardware alone.

Three products, one version range, one week

Adobe's advisory lists the same affected range across all three products it patched.

Product	Affected versions	Fixed
Adobe Commerce	2.4.4 through 2.4.9 (Aug. 2026 release and earlier)	Sept. 7, 2026
Adobe Commerce B2B	1.3.3 through 1.5.3	Sept. 7, 2026
Magento Open Source	2.4.4 through 2.4.9 (Aug. 2026 release and earlier)	Sept. 7, 2026

CISA cut the usual patch window to three days

CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on Sept. 8, 2026, giving federal civilian agencies until Sept. 11 to apply the fix, a three-day window that is short even against CISA's own usual two- to three-week allowance for actively exploited bugs. The catalog entry also directs agencies to CISA's forensic-triage guidance rather than treating a patch alone as sufficient, which matches Adobe's own advisory: applying the hotfix stops new intrusions but does not remove a backdoor already planted on a compromised store.

Adobe's advisory does not say how many merchants were compromised before the hotfix shipped, and no source cited here provides a verified count. What is confirmed is the order of events: exploitation before disclosure, disclosure before a patch, and a patch that arrived after Sansec had already reproduced the attack independently. Store operators who have not applied VULN-39341 and confirmed no lingering cron jobs or disguised processes from Narang's list should treat the store as compromised rather than merely unpatched.

This site has covered other CISA-driven patch deadlines this month, including a 9.8-severity flaw in the lwIP network stack's MQTT client and three bugs that let an Eufy Omni vacuum be hijacked. All three moved from disclosure to a mandated federal deadline in under two weeks.