Adobe hotfix: Magento stores remain compromised

CISA added CVE-2026-75650 to its catalog of known exploited vulnerabilities on 8 September 2026. Adobe confirms unauthenticated code execution in Adobe Commerce and Magento Open Source and released emergency hotfix APSB26-146 on 7 September. The patch does not remove existing compromises. September release APSB26-138 does not replace the emergency fix.

Related: CISA lists Ray: browsers launch cluster jobs without login  ·  Cyber Resilience Act (CRA) reporting begins: early warning within 24 hours

CISA adds CVE-2026-75650 to the KEV catalog

The United States Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its catalog of known exploited vulnerabilities on 8 September 2026. This Known Exploited Vulnerabilities Catalog (KEV) lists vulnerabilities that attackers are already exploiting. One of the four additions is CVE-2026-75650 in Adobe Commerce and Magento Open Source.

CISA describes the vulnerability class as improper neutralization of special elements in a template engine. A template engine generates the store’s HTML pages from templates. Special elements are control characters in these templates that can trigger code execution if the engine fails to neutralize them. The agency announced the addition in a CISA alert dated 8 September 2026.

The catalog entry gives the Date Added as 8 September 2026. The Due Date is 11 September 2026. US federal agencies must patch affected installations by that date. CISA also requires a forensic review of affected installations.

CISA lists the vulnerability’s use in ransomware campaigns as unknown. The deadline applies to US federal agencies. The technical vulnerability affects Adobe Commerce and Magento Open Source equally in every country.

Adobe confirms unauthenticated code execution in stores

Adobe states in its Knowledge Base that CVE-2026-75650 is being actively exploited and affects merchants using Adobe Commerce. An unauthenticated attacker can execute arbitrary code on an affected installation, running programs on the store’s server without logging in. The Adobe Knowledge Base article on APSB26-146 lists its last update as 8 September 2026.

What is APSB26-146? Adobe’s emergency hotfix for CVE-2026-75650, released on 7 September 2026 as VULN-39341. It must be installed in addition to September release APSB26-138 and does not remove existing compromises.

Adobe released emergency hotfix APSB26-146 on 7 September 2026. Sansec puts the release time at 20:20 UTC. Almost three days elapsed between the first confirmed exploitation and this patch, during which affected stores had no vendor fix.

Adobe rates APSB26-146 as Priority 1, its highest level. Sansec uses the same rating. Tenable and Sansec give the vulnerability a Common Vulnerability Scoring System (CVSS) score of 10.0. 10.0 is the highest score on the scale. Both sources describe exploitation without authentication.

Tenable adds that the Scope is changed. This means exploitation can affect resources beyond the vulnerable component. Adobe describes the patch in its Knowledge Base as a critical security update. Sansec provides its assessment in the StyleSmuggler analysis, while Tenable covers it in an FAQ on CVE-2026-75650. Adobe’s bulletin is available under APSB26-146.

Adobe limits affected versions to the August 2026 releases

Adobe’s Knowledge Base lists the August 2026 releases of the affected product lines.

The emergency fix is called hotfix VULN-39341. Adobe provides the file VULN-39341-composer-patches.zip, among others, and also lists version-specific patch archives. Composer is the PHP package manager used to install updates on many Magento installations. Adobe says operators must apply the appropriate patch for their version and rotate the encryption keys.

StyleSmuggler hits stores for almost three days before a vendor patch

Sansec calls the campaign StyleSmuggler. It dates the first confirmed exploitation to 4 September 2026 at 22:20 UTC. Sansec puts discovery 20 minutes later, at 22:40 UTC. Almost three days therefore elapsed between discovery and Adobe’s hotfix on 7 September 2026 at 20:20 UTC, with no vendor patch available.

According to Sansec, the campaign runs in two stages using styles and a payment-failed email. Styles are the store’s style templates. The payment-failed email is the message Magento sends after a failed payment. Sansec updated its report on 7 September 2026 at 20:45 UTC.

The hotfix closes the vulnerability. It does not remove existing compromises. A compromise here means an attacker has already taken over the store, read credentials or planted malware loaders. Applying a patch afterward does not remove these traces.

The number of German merchants affected is unknown. Tenable and incident response firm Disrex cite at least two stores without specifying a country.

A second attacker plants PHP loaders under pub/media

On 7 September 2026, Sansec describes a second attacker. This attacker uses a PHP dropper and a webshell under pub/media. A PHP dropper is a small script that downloads additional malware. A webshell is a script loaded onto the server that allows remote control.

pub/media is a Magento installation’s publicly accessible media directory. The web server can serve files stored there. A webshell in this location remains accessible after patching alone until someone removes the file.

The attacker group is unknown.

Adobe requires rotation of the encryption key and credentials

After patching, Adobe requires operators to rotate the encryption key and all credentials at their source. The encryption key is the Magento installation’s key for protecting stored secrets. Credentials provide access to services the store uses. At their source means the secrets must be changed where they were issued.

Adobe makes clear that rotating the encryption key alone does not invalidate secrets that have already been read. An attacker who copied the key or derived credentials during the almost three days without a vendor patch still has those values. A new key in the store does not revoke the attacker’s old copy.

Adobe requires the same operator to take two remediation steps: install VULN-39341 and perform the rotation. A store that only installs the hotfix does not meet Adobe’s requirement.

“Adobe is aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants.”

Adobe, Knowledge Base article on APSB26-146

APSB26-138 does not replace hotfix VULN-39341

Adobe published September release APSB26-138 on 8 September 2026 with a Priority 2 rating. Priority 2 is below the Priority 1 rating assigned to APSB26-146. Adobe notes that the hotfix for CVE-2026-75650 must be installed in addition to the September release.

APSB26-138 does not replace VULN-39341. Adobe requires VULN-39341 as an additional patch. An operator who installs only the monthly release dated 8 September 2026 leaves CVE-2026-75650 unpatched.

It remains unclear whether attackers have already shared the planted webshell, PHP loader or stolen credentials. CISA requires a forensic review and sets the Due Date at 11 September 2026. The CISA deadline for US federal agencies is 11 September 2026. Whether Adobe will incorporate the hotfix into a regular release remains unclear.

Frequently asked questions

Each question is closed. Tap to reveal the answer.

Editor’s Picks

▣Editor’s PickAttacker accounts remain active after the Artifactory patch▣Editor’s PickN-central: Remote takeover possible without a patch▣Editor’s PickLoadMaster in the KEV List: Patch Has Been Available Since June

More from the MBF Media Network

▣cloudmagazinAWS Restores Private Preview Access to Azure After Removal▣MyBusinessFutureWindows 11 limits what AI agents can access▣Digital ChiefsOrphaned Access: The Silent Cybersecurity Gap

Image source: AI-generated (September 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.