Adobe Commerce: Remote code execution via template engine injection
Deadline for US federal agencies: 11 Sep 2026
Summary
Adobe Commerce, Adobe Commerce B2B and Magento Open Source contain a template engine injection flaw (CWE-1336) that allows arbitrary code execution in the context of the current user. The attack requires no authentication and no user interaction, and the scope is changed (CVSS 10.0). Adobe confirms active exploitation in the wild, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Affected
- Adobe Commerce 2.4.4 to 2.4.9 (per Adobe bulletin APSB26-146, "2026-aug and earlier")
- Adobe Commerce B2B 1.3.3 to 1.5.3 ("2026-aug and earlier")
- Magento Open Source 2.4.6 to 2.4.9 (per the CVE record; a secondary source reports 2.4.4 to 2.4.9, so check the bulletin table)
Fixed in
- Adobe hotfix for APSB26-146 (called VULN-39341 in secondary sources; the CVE record names a hotfix for CVE-2026-7565)
- Adobe's knowledge base lists the hotfix as compatible with 2.4.4 to 2.4.7
- Unknown: a fixed release for 2.4.8 and 2.4.9 could not be confirmed from the sources; confirm with Adobe before assuming a fix
Workaround
- Unknown: no workaround replaces the hotfix
- Cloud customers: follow the cron-disable step in Adobe's knowledge base before applying the hotfix
Exploitation
- Adobe confirms the vulnerability is exploited in the wild
- Exploitation reportedly began on September 4, 2026, before the hotfix was released
- Reported payloads include a Rust-based Linux backdoor and PHP web shells
- Added to CISA KEV on 2026-09-08 with a federal remediation deadline of 2026-09-11
- A public IOC toolkit exists on GitHub; a PoC label is unverified
- No public attribution to a specific threat actor as of 2026-09-08
Our recommendation
- Inventory all Commerce, B2B and Magento Open Source instances with exact version and patch level
- Apply the APSB26-146 hotfix immediately and confirm the fixed release for 2.4.8 and 2.4.9 with Adobe
- Check for compromise (web shells, unknown backdoors, unexpected files) and review logs for the period since September 4, 2026
- Rotate credentials, including admin accounts and payment gateway keys at the provider; changing the encryption key does not revoke already stolen credentials
- Patching does not prove the store was clean; treat exposed secrets as compromised
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (7 repositories)
jithinkrishnanrs/stylesmuggler-ioc-toolkit · dinosn/cve-2026-75650-magento-validation-lab · disrex-group/stylesmuggler-adobe-patches · disrex-group/stylesmuggler-adobe-patches-mageos · fortbridge/stylesmuggler
Research sources
- Adobe Security Bulletin APSB26-146 helpx.adobe.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CISA KEV addition alert, 2026-09-08 www.cisa.gov
- Adobe Commerce Knowledge Base: APSB26-146 experienceleague.adobe.com
- Tenable: StyleSmuggler FAQ www.tenable.com
- The Hacker News: Adobe patches Magento zero-day thehackernews.com
- Akamai: CVE-2026-75650 StyleSmuggler analysis www.akamai.com
- SentinelOne vulnerability database: CVE-2026-75650 www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:50.
Original description (NVD)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.