Adobe released the APSB26-146 security update on 7 September 2026 for CVE-2026-75650, known as StyleSmuggler. The critical vulnerability could allow an unauthenticated attacker to execute code on an affected Adobe Commerce or Magento Open Source installation. Adobe said it was aware of exploitation in the wild.
The affected versions vary by product and patch level. Merchants should check their exact installation against Adobe’s bulletin and version-specific hotfix guidance.
Sansec reported attacks beginning on 4 September, before the hotfix was available. Applying the fix addresses the vulnerability, but a merchant whose store was compromised beforehand also needs to investigate and remediate that compromise.
What patching does and does not do
The VULN-39341 hotfix addresses the template-engine vulnerability used by StyleSmuggler. Once correctly applied, it prevents exploitation through that vulnerability. It does not, by itself, remove malicious files, revoke exposed credentials or establish whether a store was compromised before installation.
Adobe’s remediation guidance calls for rotation of the Commerce encryption key and credentials that might have been exposed.
Researchers have documented different malicious implants associated with the attacks. The practical response is to examine the affected environment for evidence of compromise rather than assume every store will show the same indicator. Sansec’s investigation provides technical context and indicators for security teams.
Adobe’s separate September 2026 security update, APSB26-138, does not replace the StyleSmuggler hotfix. Adobe instructs customers to apply the CVE-2026-75650 hotfix in addition to the security updates in APSB26-138. Check the status of both fixes.
The four things you need to do
Apply the hotfix to every affected instance, including staging
Identify the version and patch level of each Adobe Commerce or Magento Open Source instance, then select the matching VULN-39341 patch from Adobe’s installation table. The VULN-39341-composer-patches.zip package applies to the versions Adobe lists alongside it; other patch levels have different downloads. Follow Adobe’s Composer patch instructions and verify that the fix has been applied.
For Adobe Commerce on Cloud merchants using its Quality Patches Tool, Adobe provides this status check:
vendor/bin/magento-patches -n status | grep "39341\|Status"
For other deployments, have your technical team verify the patch using the method appropriate to your environment. Include internet-accessible staging and other affected instances in the review.
Scan for compromise indicators
If an affected store was online before its hotfix was applied, investigate whether it was exploited. Review application and server logs, unexpected PHP files or file changes, administrator activity, scheduled tasks and outbound connections. Compare findings with Sansec’s published indicators, and involve an incident-response specialist where compromise is suspected.
No single indicator can establish that a store is clean. The scope of the investigation should reflect the store’s exposure and what the initial checks reveal.
Rotate credentials after applying the patch
Adobe’s remediation instructions call for merchants to apply the hotfix, rotate the Commerce encryption key and rotate credentials that could have been exposed. These include administrator passwords, integration tokens, OAuth secrets, payment-provider credentials, database credentials, deployment keys and relevant third-party service credentials.
Rotate credentials at their source, such as the payment provider or connected service, as well as updating their values in Commerce. Rotating the encryption key alone does not invalidate a credential an attacker might already have obtained. Follow Adobe’s operational sequence, including its maintenance-mode and cron instructions, when planning the rotation.
The extent of any additional incident response depends on what the investigation finds.
Review your September security release status separately
Confirm whether the APSB26-138 September security updates have also been installed. They address other vulnerabilities, while the VULN-39341 hotfix addresses CVE-2026-75650. Adobe says to apply the hotfix in addition to the September updates.
The broader context
StyleSmuggler illustrates why a security update and an incident investigation serve different purposes. Adobe issued a priority-one bulletin for a critical vulnerability it said was being exploited; Sansec reported attacks before the hotfix was released. For a store exposed during that period, the priorities are to confirm the correct fix, investigate possible compromise and complete the relevant credential rotation.
Continue routine patching and monitoring after this incident. When assessing a store today, consult Adobe’s current advisories for its exact installed version.
About On Tap
On Tap is an eCommerce consultancy and Adobe Commerce partner helping merchants maintain, patch and monitor their stores. Its team can assist with hotfix deployment, compromise investigation and the operational steps needed to restore confidence in an affected environment.
If you have applied the StyleSmuggler hotfix and need help checking your store for compromise, get in touch.
