Loading vulnerability…
StyleSmuggler
StyleSmuggler is a critical unauthenticated template-engine injection vulnerability affecting Adobe Commerce 2.4.4–2.4.9, Magento Open Source 2.4.6–2.4.9, and Adobe Commerce B2B 1.3.3–1.5.3, including their August 2026 releases. It permits arbitrary PHP execution with the privileges of the web application, without user interaction, and has a CVSS v3.1 score of 10.0.
The exploitation chain stores attacker-controlled PHP in an application log or error report, then uses guest-cart operations and failed-payment email rendering to process attacker-controlled template directives. A template-filter trust-marker flaw allows those directives to instantiate an email Preview block and a ColumnSet object. Attacker-controlled style data can then select an AWS S3Client constructor callback that invokes ArrayScanner::collectEntities, which includes the poisoned report and executes its embedded PHP. Exploitation in the wild was observed before Adobe released its September 7, 2026 hotfix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises application confidentiality, integrity, and availability within the web-server account's permissions. Attackers can access customer records, database credentials, payment-related secrets, and the Commerce encryption key; modify storefront behavior; deploy payment skimmers, web shells, or backdoors; and disrupt store operations. Observed compromises included persistent Rust backdoors and PHP web shells. Persistence can survive application updates. The vulnerability does not inherently grant operating-system root privileges.
If you can’t patch tonight, do this now.
Until the hotfix is deployed, restrict network exposure of affected Commerce services wherever operationally feasible. Apply request-level WAF or virtual-patching rules covering PHP and command-injection patterns in request headers, query parameters, and bodies. Such controls provide incomplete protection: URL- and header-only inspection misses body-based variants, and rotating attack sources limit IP-reputation blocking. Monitor for unexpected PHP artifacts, child processes, outbound connections, and scheduled-task persistence. Preserve relevant process and application evidence before terminating suspected implants.
Patch, then assume compromise.
Immediately install Adobe hotfix VULN-39341 for CVE-2026-75650 following security bulletin APSB26-146, and verify its installation across production and staging deployments. Apply it in addition to other applicable security updates; retain the September hotfix when applying the separate October Blockstrap fix. Upgrade unsupported product branches to supported releases. The hotfix adds Preview access checks, rejects array-valued template styles, validates row URL generators before construction, and hardens report generation. Investigate previously exposed systems for compromise, preserve evidence, and remove implants and persistence. Following containment, rotate the Commerce encryption key and associated credentials and secrets, including administrator passwords, API and OAuth tokens, database and payment-gateway credentials, and deployment keys. Patching alone does not remove an existing compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
194 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.