StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento
StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento A storefront can pass every routine security check and still be running an exploitable template engine. That is the situation Adobe Commerce and Magento Open Source merchants faced in September 2026, when attackers turned an ordinary transactional email into an unauthenticated remote code execution path. The…
Adobe Commerce and Magento Open Source merchants encountered a security issue in September 2026 that turned ordinary transactional emails into a pathway for remote code execution. The vulnerability, named StyleSmuggler by Sansec, is CVE-2026-75650. Adobe assigned it a high CVSS score of 10.0 with a critical classification under CWE-1336 for improper neutralization of special elements used in a template engine.
The flaw resides in how Magento renders template styles. Attackers inject malicious PHP code into data generated by Magento, like a payment failure report. When Magento renders the template for the Payment Transaction Failed Reminder email, it inadvertently allows the execution of the injected code. This attack does not require administrative login or a link click.
The polluted data runs with web server process permissions. The post-exploitation payload is a small Rust backdoor disguised as legitimate processes to avoid detection. It communicates with its command and control over UDP port 123, resembling NTP time synchronization. Some variants embed themselves in system directories for persistence.
Adobe Commerce versions 2.4.4 through 2.4.9, along with Magento Open Source versions 2.4.6 through 2.4.9, are affected, even if the August 2026 patches were applied. Sansec first observed exploitation on September 4th, 2026, while Adobe released a hotfix on September 7th, leaving a three-day window for attacks. CISA listed the vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 11th.
Remediation requires applying Adobe's hotfix VULN-39341, rotating encryption keys and other credentials first, followed by changing administrator passwords, REST, SOAP, and GraphQL tokens, payment gateway API credentials, database accounts, and SSH keys. Detection involves checking the pub/media directory for unauthorized PHP files, monitoring for unexpected processes and scheduled tasks, and observing for UDP port 123 traffic.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
