Last updated: September 8, 2026

StyleSmuggler is a critical remote code execution vulnerability affecting Magento Open Source and Adobe Commerce. Tracked as CVE-2026-75650, the vulnerability has a CVSS score of 10.0 and is being actively exploited in the wild.

The vulnerability is particularly serious because exploitation does not require authentication or user interaction. Successful exploitation can allow an attacker to execute arbitrary code on a vulnerable Magento or Adobe Commerce server.

At the time of writing, Adobe has released an emergency hotfix and organizations running affected versions should treat deployment as an immediate priority.

What is StyleSmuggler? Sansec's CVE-2026-75650 research

StyleSmuggler was publicly disclosed by ecommerce security company Sansec, which reported observing exploitation before the vulnerability was publicly known. Sansec's research documented the attack chain, affected Magento versions and post-compromise activity, and remains one of the primary public technical references for CVE-2026-75650.

StyleSmuggler was publicly disclosed after exploitation had already been observed in the wild.

The vulnerability abuses otherwise legitimate Magento functionality to move attacker-controlled content through several stages before it is ultimately interpreted during template rendering.

At a high level, the attack consists of three steps:

1. Plant attacker-controlled content. A specially crafted request can cause PHP content supplied through a Store: header to be rejected by Magento but subsequently written into a log file.
2. Trigger template rendering. The attacker causes Magento to process a failed payment workflow. Magento generates its normal payment-failure email, and the vulnerable behavior occurs while that content is being rendered. No user needs to open or interact with the email.
3. Redirect Magento's template processing. Attacker-controlled styles[...] parameters are used to influence Magento's rendering machinery so that previously written content is treated as template input, resulting in code execution.

This is where the StyleSmuggler name comes from: malicious behavior is effectively smuggled through parameters that appear related to styling.

The exact mechanism by which the attacker-controlled style parameters are introduced into the relevant email-rendering path has not been publicly detailed at the time of writing. Public research has documented the surrounding stages of the attack, but this final linkage remains an important technical gap.

Why StyleSmuggler is difficult to detect

One reason this vulnerability is notable is that several individual stages of the attack can resemble normal application behavior.

The initial log entry may appear to be an ordinary application error. Payment-failure emails are legitimate Magento functionality. Parameters associated with styling can also look relatively benign when considered in isolation.

That means defenders should avoid relying on a single indicator.

Detection is more likely to be effective when activity is correlated across multiple stages, particularly:

• Unusual or attacker-controlled values in the Store HTTP header
• PHP syntax or suspicious encoded content appearing in Magento log files
• Unexpected styles[...] request parameters
• Unusual bursts of failed-payment processing
• Payment Transaction Failed Reminder activity that correlates with suspicious inbound requests
• PHP execution, unexpected child processes or filesystem changes shortly after the above events

These indicators should be treated as investigative leads rather than proof of compromise individually.

CVE-2026-75650 impact

Adobe assigned the vulnerability CVE-2026-75650 and rated it CVSS 10.0 Critical.

Successful exploitation provides unauthenticated remote code execution within the affected application context.

Depending on the environment and subsequent attacker actions, this could enable:

• Theft of application data or credentials
• Modification of ecommerce content
• Installation of persistent backdoors
• Access to customer or payment-related information
• Lateral movement from the compromised server
• Deployment of additional malware

Because Magento and Adobe Commerce installations are typically internet-facing and handle commercially sensitive data, successful exploitation can have significant operational and security consequences.

Active exploitation of StyleSmuggler

Sansec reported that it first observed StyleSmuggler exploitation on September 4, 2026, before the vulnerability had been publicly disclosed. Following Sansec’s publication and the exploitation evidence it provided, Previdian added the vulnerability to our Known Exploited Vulnerabilities feed at 12:44 UTC on September 5, while it still had no CVE identifier.

Adobe subsequently assigned and published CVE-2026-75650 on September 7, 2026, along with its security advisory and hotfix. Previdian sensors then independently observed exploitation attempts targeting the vulnerability beginning on September 7.

As of September 8, Previdian sensors have recorded:

• 12 exploitation attempts
• 2 unique attacker IP addresses
• Activity originating from 2 countries
• First Previdian sensor observation on September 7
• Continued activity observed on September 8

Our telemetry supports the conclusion that attackers are actively probing or attempting to exploit the vulnerability.

Importantly, none of the exploitation attempts observed within our sensors resulted in a successful compromise.

We therefore classify our first-party observations specifically as exploitation attempts, rather than claiming those individual attacks successfully compromised a target.

Successful exploitation has, however, been documented separately in public research, and Adobe has confirmed exploitation in the wild.

Is there a public StyleSmuggler PoC?

At the time of writing, we have not identified a reliable public, end-to-end proof-of-concept exploit for CVE-2026-75650.

Significant portions of the vulnerability's mechanics are now understood, but a critical part of the complete exploit chain has not been publicly documented.

That situation could change quickly.

The release of Adobe's official hotfix gives researchers additional material to analyse, while continued technical research may reveal more about the underlying vulnerability.

Organizations should therefore not interpret the absence of a public end-to-end PoC as evidence of low exploitation risk.

Attackers were already successfully exploiting the vulnerability before public disclosure.

Which Magento and Adobe Commerce versions are affected?

The vulnerability affects multiple releases across:

• Adobe Commerce
• Adobe Commerce B2B
• Magento Open Source

According to Sansec's research, every version from 2.4.4 up to and including 2.4.9 is affected. Administrators should check Adobe's security advisory against the exact version deployed rather than assuming that an installation is safe because it had received all security updates available before the StyleSmuggler disclosure.

Is a patch available for CVE-2026-75650?

Yes.

Adobe has released an official hotfix (APSB26-146) for CVE-2026-75650.

Organizations running affected Adobe Commerce or Magento installations should prioritize applying the vendor hotfix immediately.

Because exploitation began before the hotfix became available, however, patching should not be considered evidence that a system was not previously compromised.

Internet-facing Magento and Adobe Commerce deployments should also be reviewed for evidence of exploitation during the period before remediation.

Detecting possible StyleSmuggler exploitation

Defenders investigating CVE-2026-75650 should correlate activity across web, application, filesystem and process telemetry.

Particular attention should be given to combinations of:

HTTP activity

Review requests for:

• Suspicious or unexpected Store: header values
• PHP syntax, encoded PHP or other executable content within header values
• Unusual styles[...] parameters
• Requests associated with unexpected failed-payment activity

These indicators will produce false positives if used too broadly, so correlation with subsequent Magento behavior is important.

Magento logs

Review Magento logs for attacker-controlled content originating from inbound requests, particularly where suspicious content appears shortly before failed-payment processing or template rendering.

PHP code or encoded executable content appearing unexpectedly within log data should be investigated.

Payment failure activity

Magento's failed-payment workflow is legitimate, so payment failure events alone are not sufficient evidence.

However, defenders should investigate unusual spikes or patterns in:

• Failed payment processing
• Payment Transaction Failed Reminder emails
• Failed-payment events immediately following suspicious inbound HTTP requests

Post-exploitation activity

Investigate unexpected:

• PHP files
• Web shells
• Cron jobs
• Background processes
• Child processes spawned by web or PHP services
• Changes within Magento application directories
• Outbound network connections

Publicly reported StyleSmuggler compromises have included persistence and web-shell activity, making host-level investigation important even after the vulnerable application has been patched.

Previdian virtual patches for CVE-2026-75650

Previdian has released virtual patches for CVE-2026-75650 to Enterprise users, providing compensating controls that can help reduce exposure while organizations test and deploy Adobe's official hotfix.

Virtual patch artifacts are available for:

• AWS WAF
• Cloudflare
• ModSecurity

These controls are designed around currently understood exploitation patterns and should be treated as an additional defensive layer, not a replacement for applying Adobe's official security update.

As more technical details become public, defensive signatures may need to evolve alongside the exploit technique.

Is CVE-2026-75650 in CISA KEV?

At the time of writing on September 8, 2026, CVE-2026-75650 is not listed in the CISA Known Exploited Vulnerabilities catalog.

Previdian nevertheless classifies the vulnerability as exploited with Confirmed confidence, based on authoritative exploitation reporting together with exploitation attempts independently observed by our sensors.

CISA KEV remains an important vulnerability-management baseline, but vulnerabilities such as StyleSmuggler demonstrate why defenders may sometimes need to respond to credible exploitation evidence before a vulnerability reaches the official catalog.

Recommended action

Organizations running Magento Open Source or Adobe Commerce should:

1. Apply Adobe's CVE-2026-75650 hotfix immediately.
2. Identify all internet-facing affected installations.
3. Review systems for signs of exploitation predating the hotfix.
4. Correlate suspicious Store: headers, styles[...] parameters and failed-payment processing.
5. Search Magento logs for unexpected executable or attacker-controlled content.
6. Investigate suspicious PHP files, processes, cron entries and outbound network connections.
7. Use compensating WAF controls where immediate patch deployment is not possible.
8. Continue monitoring CVE-2026-75650 as exploitation techniques and indicators evolve.

Given the CVSS 10.0 severity, unauthenticated remote code execution and confirmed exploitation, CVE-2026-75650 should be treated as an immediate remediation priority.

Track CVE-2026-75650

Previdian is continuing to monitor StyleSmuggler exploitation activity through proprietary sensors and private honeypots.

Our live CVE-2026-75650 vulnerability intelligence page includes current exploitation status, confidence, first-party sensor observations, affected versions, timeline information and available defensive artifacts.

Previdian will continue updating the record as exploitation techniques, public technical details and defensive indicators develop.