Adobe Commerce and Magento Open Source merchants affected by the StyleSmuggler vulnerability should treat it as an urgent security issue.
Security researcher Sansec published its analysis of StyleSmuggler on 5 September 2026 after identifying confirmed exploitation on 4 September.
Adobe subsequently disclosed the vulnerability as CVE-2026-75650 in security bulletin APSB26-146 on 7 September 2026.
Adobe assigned the vulnerability the maximum CVSS score of 10.0 and a Priority 1 rating, its highest update priority. Adobe also confirmed that it was aware of CVE-2026-75650 being exploited in the wild.
The vulnerability can allow an unauthenticated attacker to execute arbitrary code on affected systems. Adobe released the VULN-39341 hotfix for affected Adobe Commerce and Magento Open Source versions and instructed merchants to apply the fix and rotate relevant credentials.
By the time this article was originally published on 15 September 2026, StyleSmuggler had therefore already been under active exploitation for more than a week and Adobe’s emergency remediation was available.
The practical question for merchants is not whether StyleSmuggler represents a real-world threat. Adobe has already confirmed that. It is whether the store is affected, whether the correct hotfix has been applied and whether the environment shows evidence of compromise before remediation.
What is StyleSmuggler?
Sansec named CVE-2026-75650 StyleSmuggler after identifying attacks against Magento and Adobe Commerce stores.
Adobe classifies the vulnerability as Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). In practical terms, it is a template injection vulnerability that can result in arbitrary code execution.
No authentication or administrator privileges are required for exploitation.
That combination makes StyleSmuggler particularly serious for internet-facing commerce environments.
Adobe’s APSB26-146 bulletin lists affected Adobe Commerce, Adobe Commerce B2B and Magento Open Source release lines.
The bulletin includes Adobe Commerce releases across supported 2.4.4 to 2.4.9 lines, while the Magento Open Source affected-version table covers supported 2.4.6 to 2.4.9 lines.
Merchants should check Adobe’s affected-version table for their exact production release and use the corresponding hotfix identified in Adobe’s remediation guidance.
Adobe and Sansec confirmed active exploitation
Sansec says it first confirmed StyleSmuggler exploitation on 4 September and published its initial analysis on 5 September.
Adobe published APSB26-146 on 7 September and stated that it was aware of CVE-2026-75650 being exploited in the wild.
This is materially different from a vulnerability that has only been demonstrated in research or assigned a theoretical severity score.
Merchants therefore need to answer two separate questions:
-
Has the vulnerability been remediated?
-
Was the store compromised before remediation?
Applying the hotfix addresses the vulnerable code path, but it does not establish that an environment was clean before the fix was installed.
For merchants that were exposed while vulnerable, On Tap recommends combining remediation with an incident review appropriate to the environment and available telemetry.
APSB26-146 is separate from the September security update
Adobe published APSB26-138 on 8 September 2026 as its scheduled Adobe Commerce and Magento Open Source security update.
StyleSmuggler is handled separately through APSB26-146.
Adobe explicitly instructs merchants to apply the CVE-2026-75650 hotfix in addition to the security updates released through APSB26-138.
That distinction matters.
Merchants that applied only the September security update should not assume that StyleSmuggler was also remediated. Where the environment is affected by both bulletins, the relevant APSB26-138 security update and the separate VULN-39341 hotfix both need to be accounted for.
Apply the VULN-39341 hotfix
Adobe’s remediation for CVE-2026-75650 is the VULN-39341 hotfix.
The exact patch package varies according to the Adobe Commerce or Magento Open Source version in use. Adobe provides the version-to-patch mapping in its StyleSmuggler hotfix guidance on Experience League.
Before production deployment, On Tap recommends:
-
confirming the exact Magento Open Source or Adobe Commerce version running in production
-
selecting the corresponding Adobe-provided VULN-39341 patch
-
following Adobe’s installation guidance for that environment
-
testing critical storefront, admin and integration flows where operationally practical
-
confirming that the hotfix is present after deployment
Because Adobe assigned APSB26-146 Priority 1 and confirmed exploitation in the wild, remediation should be treated as an urgent security change rather than deferred to a future routine upgrade.
Confirm the hotfix is applied
Adobe provides an additional verification procedure for Adobe Commerce on Cloud environments using the Quality Patches Tool.
Adobe documents the following status check:
vendor/bin/magento-patches -n status | grep "39341\|Status"
The VULN-39341 patch should appear with a status of Applied.
This verification method is specifically documented by Adobe for Commerce on Cloud. Merchants on other deployment models should use the appropriate deployment and patch-verification process for their environment.
Credential rotation is part of the remediation
Installing the VULN-39341 hotfix is not the end of Adobe’s remediation guidance.
Adobe says full remediation also requires merchants to rotate the Commerce encryption key and credentials that could have been encrypted with or exposed through that key.
Adobe’s APSB26-146 remediation guidance includes items such as:
-
Admin user passwords
-
REST, SOAP and GraphQL integration tokens
-
OAuth client secrets
-
payment gateway API credentials
-
database credentials
-
SSH and deployment keys
-
credentials used by cron jobs or other privileged service accounts
-
API keys for shipping, tax and other connected third-party services
A key point in Adobe’s guidance is that rotating the Commerce encryption key alone does not invalidate credentials that may already have been exposed.
Those credentials need to be rotated at their source, such as the payment gateway or third-party service, as well as updated within Commerce where required.
On Tap recommends documenting each credential rotation and checking dependent systems afterwards to confirm that integrations continue to operate correctly.
Check for signs of compromise
Patching closes the known vulnerability, but merchants that were exposed before remediation should also assess whether exploitation occurred.
Sansec reported active attacks beginning before Adobe released the hotfix, which creates an exposure window for stores that remained vulnerable during that period.
On Tap recommends reviewing the evidence available for the environment, which can include:
-
unexpected file changes
-
newly created or modified executable files
-
unusual application or web-server activity
-
unexpected admin or API behaviour
-
suspicious outbound requests
-
unexpected cron jobs or persistence mechanisms
-
security-monitoring alerts
-
malware and compromise-scan findings
The exact investigation should reflect the architecture and available logging.
An absence of obvious symptoms should not be presented as proof that exploitation did not occur.
At the same time, confirmed exploitation in the wild does not mean that every vulnerable Adobe Commerce or Magento Open Source store was compromised.
Where indicators of compromise are found, merchants should move from routine patch management to an incident-response process appropriate to the scope of the suspected compromise.
Why the CVSS 10.0 and Priority 1 ratings matter
Adobe assigned CVE-2026-75650 a CVSS 3.1 base score of 10.0, the maximum possible score, and classified APSB26-146 as Priority 1.
For merchants, those ratings should be considered alongside the other characteristics Adobe documents:
-
exploitation does not require authentication
-
administrator privileges are not required
-
successful exploitation can result in arbitrary code execution
-
Adobe confirmed exploitation in the wild
Together, these factors support urgent remediation.
The severity should not, however, be converted into unsupported claims about how quickly every vulnerable store will be compromised or what an attacker will inevitably do after gaining access.
What merchants should do now
If your Adobe Commerce or Magento Open Source environment is within the affected versions, Adobe’s remediation guidance should be the starting point.
Adobe's remediation
-
Review APSB26-146 and confirm whether your production version is affected.
-
Apply the appropriate VULN-39341 hotfix using Adobe’s installation guidance.
-
Rotate the Commerce encryption key.
-
Rotate credentials that may have been exposed, including relevant server, API, integration and payment credentials.
-
If applicable, also install the separate security updates covered by APSB26-138.
-
For Adobe Commerce on Cloud, use Adobe’s documented Quality Patches Tool check to confirm that VULN-39341 is applied.
On Tap's additional recommendations
-
Review logs and security telemetry covering the period before remediation.
-
Scan the environment for unexpected files, processes or other indicators of compromise.
-
Review connected systems where credentials could have been exposed.
-
Preserve relevant logs and evidence if suspicious activity is identified.
-
Test critical payment, checkout and integration flows after credential rotation.
-
Escalate to an incident-response investigation if indicators of compromise are found.
Merchants making changes today should also check Adobe’s current Commerce and Magento security bulletin index before deployment to confirm that the remediation guidance has not changed.
The bigger picture
StyleSmuggler is a serious Adobe Commerce and Magento Open Source vulnerability because it combines maximum technical severity, unauthenticated arbitrary code execution and confirmed exploitation in the wild.
The response therefore needs to go beyond a routine future platform upgrade.
Affected merchants should confirm their exposure, apply the VULN-39341 hotfix, complete Adobe’s credential-rotation steps and investigate for signs of compromise where appropriate.
The separate release of APSB26-146 also makes patch management particularly important. Adobe explicitly says the StyleSmuggler hotfix should be applied in addition to the September APSB26-138 security updates.
Security controls such as Web Application Firewalls, file-integrity monitoring and malware scanning can provide useful additional layers of protection and detection, but they should not be treated as substitutes for Adobe’s hotfix and remediation guidance.
About On Tap
On Tap provides Magento and Adobe Commerce development, hosting, maintenance and security support for mid-market and enterprise merchants.
Our services include platform security updates, vulnerability response, infrastructure management, monitoring and incident investigation.
If you need help confirming whether VULN-39341 has been applied, reviewing your environment for StyleSmuggler exposure or responding to signs of compromise, contact the On Tap team.
