{
  "id": 8328411,
  "title": "When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650",
  "url": "https://urgent.news/2026/09/18/when-the-payment-failure-email-is-the-exploit-inside-the-magento",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T23:20:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/when-the-payment-failure-email-is-the-exploit-inside-the-magento-template-rendering-chain-of-f49"
  },
  "original_language": "en",
  "account": "The CVE-2026-75650 vulnerability, an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, was first noted on 4 September 2026. This issue, classified as CWE-1336 due to improper neutralization of special elements in a template engine, affects versions ranging from 2.4.4 through 2.4.9 and 2.4.6 through 2.4.9. Adobe Commerce B2B 1.3.3 through 1.5.3 is also vulnerable. Stores that applied the August 2026 monthly patch were still at risk, necessitating a separate hotfix (VULN-39341) published on 7 September 2026 under advisory APSB26-146.\n\nThe attack chain involves placing poisoned data in Magento-generated records like error reports and payment transaction data. When the Payment Transaction Failed Reminder email is triggered, the template engine processes this data without adequate neutralization. This allows the attacker to execute the poisoned data as PHP with web-server privileges through an object-injection chain into Magento's dependency-injection container. Observed payloads include a Rust backdoor disguised as kernel-thread and system processes, small PHP web shells, and communications over UDP 123 disguised as NTP traffic.\n\nEarly detection indicators include a burst of \"payment failed\" notification emails with no corresponding failed orders, as the exploit rides on the same rendering path. To remediate, rotate credentials in a specific order: encryption keys, then admin passwords, API tokens, payment gateway credentials, database accounts, and SSH keys. Post-compromise, check the pub/media directory for unauthorized PHP files and monitor for processes mimicking kernel threads, font or time services, and egress to UDP 123.\n\nAdobe assigned a CVSS score of 10.0 to this flaw. For EOL versions like 2.4.0-2.4.3, only community backports are available, which are unverified by Adobe and require staging validation before production use. This case highlights the risk in transactional email rendering, urging a heightened security posture treating store email sending as an attack surface.",
  "summary": "When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler,…",
  "key_points": [
    "CVE-2026-75650 flaw allows unauthenticated remote code execution in Magento platforms.",
    "Remediation requires credential rotation in specific order to mitigate post-compromise risks."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}