When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler,…
The CVE-2026-75650 vulnerability, an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, was first noted on 4 September 2026. This issue, classified as CWE-1336 due to improper neutralization of special elements in a template engine, affects versions ranging from 2.4.4 through 2.4.9 and 2.4.6 through 2.4.9.
Adobe Commerce B2B 1.3.3 through 1.5.3 is also vulnerable. Stores that applied the August 2026 monthly patch were still at risk, necessitating a separate hotfix (VULN-39341) published on 7 September 2026 under advisory APSB26-146.
The attack chain involves placing poisoned data in Magento-generated records like error reports and payment transaction data. When the Payment Transaction Failed Reminder email is triggered, the template engine processes this data without adequate neutralization. This allows the attacker to execute the poisoned data as PHP with web-server privileges through an object-injection chain into Magento's dependency-injection container.
Observed payloads include a Rust backdoor disguised as kernel-thread and system processes, small PHP web shells, and communications over UDP 123 disguised as NTP traffic.
Early detection indicators include a burst of "payment failed" notification emails with no corresponding failed orders, as the exploit rides on the same rendering path. To remediate, rotate credentials in a specific order: encryption keys, then admin passwords, API tokens, payment gateway credentials, database accounts, and SSH keys. Post-compromise, check the pub/media directory for unauthorized PHP files and monitor for processes mimicking kernel threads, font or time services, and egress to UDP 123.
Adobe assigned a CVSS score of 10.0 to this flaw. For EOL versions like 2.4.0-2.4.3, only community backports are available, which are unverified by Adobe and require staging validation before production use. This case highlights the risk in transactional email rendering, urging a heightened security posture treating store email sending as an attack surface.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
