StyleSmuggler (CVE-2026-75650): Magento, Adobe Commerce Affected by 0-day RCE
ID: c778fe3e-efe5-5300-86be-4ad9c2ce47f8
STIX ID: report--c778fe3e-efe5-5300-86be-4ad9c2ce47f8
Feed Name: Kudelski Security
StyleSmuggler (CVE-2026-75650) is an actively exploited unauthenticated RCE affecting Magento Open Source (confirmed 2.4.4–2.4.9) and potentially Adobe Commerce: attackers inject PHP into files Magento writes and trigger execution during the "Payment Transaction Failed Reminder" email rendering to deploy statically linked Rust backdoors with persistence and C2 communications; the advisory provides technical details, IoCs (domains, IPs, SHA256s), mitigation steps (Adobe hotfix, disable GraphQL, PHP disable_functions, mount noexec), and compromise response actions.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.