CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors

**StyleSmuggler (CVE-2026-75650)** is a critical (CVSS 10.0) unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that was actively exploited in the wild beginning September 4, 2026; attackers used it to write PHP into server-accessible files and trigger Magento's template-processing to execute that code, resulting in deployments of a Rust-based persistent Linux backdoor and PHP web shells. Adobe published emergency bulletin APSB26-146 and hotfix VULN-39341 on September 7; the report provides affected versions, IOCs (suspicious processes, PHP files under pub/media, cron persistence, outbound infrastructure), detection guidance, and recommends immediate patching, forensic investigation, and rotation of encryption keys and credentials.