Unauthenticated template-injection RCE in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler
Adobe shipped the APSB26-146 fix on 2026-09-07 and CISA added the flaw to KEV on 2026-09-08 with a 2026-09-11 deadline after attackers were seen using it to drop a PHP web shell and Rust backdoor on unpatched stores, so any storefront still on a pre-fix build should be treated as reachable by unauthenticated attackers right now.
A template-engine injection flaw (improper neutralization of special elements) lets an unauthenticated remote attacker execute arbitrary code on an Adobe Commerce or Magento Open Source server with no user interaction. Reported attacks deployed a PHP web shell and a Rust backdoor on compromised stores.
Affected: Adobe Commerce < 2.4.4; Adobe Commerce 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9 (through the 2026-aug security patch level); Adobe Commerce B2B < 1.3.3, 1.3.3, 1.3.4; Magento Open Source (same 2.4.x lines)
How to Test
Confirm the installed Commerce/Magento version and security-patch level against the APSB26-146 advisory; any 2.4.4–2.4.9 install at or below the 2026-aug patch level without the CVE-2026-75650 hotfix is vulnerable. Because attacks predate the patch (reported from September 4), review the web root and pub/ directories for recently created or modified PHP files, check for unexpected running binaries or persistence consistent with the reported Rust backdoor, and review web server access logs for unusual POST requests to storefront endpoints around and after 2026-09-04.
How to Patch
Apply the Adobe security update or hotfix published in APSB26-146 (https://helpx.adobe.com/security/products/magento/apsb26-146.html) for your 2.4.x line and the B2B extension; Adobe Commerce cloud customers should confirm the fix is deployed on their environment. If you cannot patch immediately, restrict public access to the storefront (WAF or network controls) until the update is applied, and treat any host that was exposed unpatched since 2026-09-04 as potentially compromised pending forensic review.