Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)

CVE-2026-75650 is a CVSS 10.0 template-engine injection vulnerability in Adobe Commerce and Magento Open Source. An unauthenticated remote attacker can inject arbitrary template directives, which the server evaluates and executes as code.

Template-engine injection occurs when user-supplied input reaches a server-side template renderer without sanitization. Adobe Commerce uses the Magento template framework to generate dynamic page output. In this flaw, an attacker passes crafted input through a public-facing endpoint, and the renderer processes it as code rather than data. Because template rendering runs with the web application’s server-level privileges, the resulting code execution has full access to the application environment and the underlying host.

The vulnerability was under active exploitation before Adobe published a patch. Attackers used it to deploy a Rust-compiled backdoor and a PHP web shell on compromised servers, per reporting by BleepingComputer and The Hacker News. The Rust binary reduces detection by signature-based tools; the PHP shell provides persistent server access.

Adobe released an emergency out-of-band patch on September 8, 2026. Affected version details and the corresponding fixed releases are in Adobe’s security bulletin. Merchants running self-hosted Adobe Commerce or Magento Open Source must apply the patch manually. Adobe Commerce Cloud deployments received the update from Adobe infrastructure.

CISA added this to the Known Exploited Vulnerabilities catalog on September 8 with a remediation deadline of September 11, 2026, under BOD 26-04. The three-day window reflects CISA’s assessment of active exploitation risk. Organizations outside the federal scope should treat that same deadline as a strong prioritization signal given confirmed pre-patch exploitation in the wild.

Adobe Commerce stores typically hold customer payment data, order histories, and account credentials. A pre-patch compromise may require investigation beyond patching, including log review and file integrity checks, to determine whether customer data was accessed or exfiltrated before the vulnerability was closed.

After patching, check for unrecognized PHP files in web-accessible directories, unexpected binaries, and newly created administrative accounts. A patch closes the entry point but does not remove payloads already deployed. Forensic indicators for the Rust backdoor and PHP shell associated with in-the-wild exploitation are detailed in the BleepingComputer report and the Adobe StyleSmuggler coverage article.

CISA added three other vulnerabilities to the catalog in the same September 8 batch: CVE-2026-81963, a Windows Update Stack link-following local privilege escalation; CVE-2026-85880, a Windows ALPC heap overflow allowing AppContainer sandbox escape; and CVE-2026-86218, a pre-authentication RCE in N-able N-central with a CVSS 10.0 score and a September 11 remediation deadline.