StyleSmuggler gets a CVE: patch Adobe Commerce today

The patch landed. Adobe published bulletin APSB26-146 on September 8, assigning CVE-2026-75650 at CVSS 10.0 to the Magento zero-day we covered while it was still an unpatched RCE backdooring live stores. Adobe confirms exploitation in the wild. The Adobe Commerce CVE-2026-75650 fix is a same-day job, and the second half of that job is rotating your keys.

What actually happened

Adobe classified the bug as improper neutralization of special elements in a template engine (CWE-1336) and rates it Priority 1 — patch inside 72 hours. It was the only Adobe flaw confirmed under active attack in this month's release, per the Zero Day Initiative's review.

Three things are new since our September 7 post:

• The affected list is official. Adobe Commerce 2.4.4 through 2.4.9, Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9, at the August 2026 releases and earlier.
• The fix is a composer hotfix, not a version bump. It ships as VULN-39341 from repo.magento.com. "We can't take a minor upgrade this sprint" is not a reason to wait on this one.
• We know what the attackers dropped. The Hacker News reports a Rust-based Linux backdoor and a PHP web shell, and that one Magento server run by an ecommerce development platform was compromised 50 minutes after the initial exploitation report went out.

Why patching Adobe Commerce is only half the job

Adobe's own remediation guidance pairs the hotfix with rotating your encryption keys, and that pairing is the whole story. This was remote code execution, not a session bug. Anything that ran in your PHP process before you patched could read env.php — which means your encryption key, your database credentials, and whatever API tokens live in that config. Patching closes the door. It does not un-copy what already walked out.

So, today, in order:

1. Apply VULN-39341 and confirm it is present in the deployed artifact, not just in your lock file.
2. Rotate encryption keys and every credential reachable from the app config. Re-encrypt saved payment tokens if you hold them.
3. Hunt for the implant. New PHP under pub/ and var/, unfamiliar Linux binaries, new cron entries, and outbound connections your storefront has no reason to make. A Rust backdoor does not appear in a Magento admin log.

If you ran an unpatched 2.4.x store any time after September 4, assume exposure and work the list. Fifty minutes from report to compromise means the window closed before most teams read the advisory — so the real question this CVE asks is whether you can detect a file that changed on your storefront last night. If the answer takes more than five minutes, that gap outlives this patch.

Sources: The Hacker News, Zero Day Initiative.