Press play to start listening
Cybersecurity researchers at Akamai’s Security Intelligence Group have released an analysis of an actively exploited zero-day vulnerability affecting Adobe Commerce and Magento Open Source.
Tracked as CVE-2026-75650 (CVSS 10.0) and dubbed StyleSmuggler, this critical remote code execution (RCE) vulnerability lets attackers run PHP code on an affected server without authentication.
According to Akamai’s research, shared with Hackread.com, this exploitation began in early September. Sansec, which originally discovered StyleSmuggler, also recorded the first confirmed exploitation on September 4 and subsequently reproduced the attack on clean Magento installations. As a result, Adobe released an emergency hotfix on September 7.
Adobe also published affected-version details for Adobe Commerce, Magento Open Source and Adobe Commerce B2B, along with an emergency hotfix for CVE-2026-75650.
How StyleSmuggler Turns Logs Into Code Execution
Akamai’s analysis found that the attack abuses Magento’s template-processing chain rather than directly executing PHP. An attacker first sends a request to a GraphQL endpoint with malicious PHP code hidden in an HTTP header or parameter. Magento then writes the attacker-controlled value to a server-side log.
The attacker triggers Magento’s template engine by initiating a standard transactional email such as a “Payment Transaction Failed Reminder.” During this process, the template engine loads the poisoned log file and executes the PHP code stored in it. This lets the attacker run commands on the server.
The attack requires neither authentication nor user interaction. Nobody needs to open the generated email because the malicious code executes while Magento renders it. Adobe classifies the vulnerability as improper neutralization of special elements used in a template engine (CWE-1336).
Linux Backdoors and Web Shells
Sansec observed persistent Linux implants on compromised stores, with malicious processes disguised using names such as , fc-cache and chronyd. Sansec also identified a second attacker exploiting StyleSmuggler to deploy a PHP web shell under a Magento product-image cache path.
Sansec analyzed one of the Linux implants as a small Rust backdoor that connected to attacker-controlled command-and-control infrastructure and waited for commands. The researchers said they had not seen evidence that the backdoor’s remote-access capability had actually been used at the time of their analysis.
Successful exploitation can leave attackers with continued access to a compromised store. Adobe recommends rotating credentials that may have been exposed, including administrator passwords, integration tokens, payment gateway credentials, and other secrets protected by the Commerce encryption key.
Adobe warns in its official advisory that rotating the Commerce encryption key alone does not invalidate credentials that may already have been exposed.
Sansec found one compromised store running Magento 2.4.6-p15 with the July and August 2026 security patches applied, showing those updates did not protect against StyleSmuggler.
Remediation Guidance
“Akamai App & API Protector’s Adaptive Security Engine CMD Injection protections natively block the primary GraphQL header- and parameter-based exploitation vectors, without requiring any new rule,” Akamai researchers said. However, the company said it was continuing to validate detection coverage against other observed and emerging exploitation methods.
No public, fully weaponized PoC for StyleSmuggler had emerged when Akamai published its analysis, even though attackers were already exploiting the flaw in the wild.
Adobe’s fix is available as hotfix VULN-39341 under security bulletin APSB26-146. Administrators should apply the patch immediately and inspect affected systems for signs of compromise. Stores that were already exploited may remain compromised after patching, so potentially exposed credentials should also be rotated.
(Photo by Growtika on Unsplash)
