NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedBeing used in attacksUpdated

Adobe Commerce and Magento StyleSmuggler attacks: hotfix and October bypass fixes required

Attackers used StyleSmuggler to compromise Adobe Commerce and Magento shops without logging in. Apply Adobe's VULN-39341 hotfix plus October security fixes, check for backdoors and rotate exposed credentials. Monthly patches alone are insufficient.

What to do

There is no device update for shoppers. If your family or business runs an Adobe Commerce or Magento shop, ask its developer or hosting provider to apply and verify hotfix VULN-39341 alongside the October security fixes. Have them check for existing compromise and follow Adobe's encryption-key and credential-rotation instructions.

What’s happening

StyleSmuggler, CVE-2026-75650, lets attackers run code on Adobe Commerce and Magento shop servers without logging in. Sansec observed compromises from 4 September and disclosed the flaw on 5 September; Adobe released an emergency hotfix on 7 September. The affected software includes Adobe Commerce, its B2B component and Magento Open Source. Sansec subsequently identified BlockStrap, CVE-2026-103849, as a bypass of the original hotfix; Adobe addressed that flaw in its October security update and reported no known exploitation of the October issues. As at 3 November, remediation still requires the separate StyleSmuggler hotfix alongside the October fixes: Adobe explicitly says its October isolated patch does not include it. Patching does not remove existing backdoors. Adobe also requires rotation of encryption keys and potentially exposed credentials, including those held by payment providers and other connected services. The reviewed reports do not establish how many shoppers were affected.

What
Flaw
Affects
Adobe Commerce, Adobe Commerce B2B and Magento Open Source
Affected
CVE-2026-75650 — Adobe Commerce: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug and 2.4.4-2026-aug, and earlier versions in each listed line.
CVE-2026-75650 — Adobe Commerce B2B: 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug and 1.3.3-2026-aug, and earlier versions in each listed line.
CVE-2026-75650 — Magento Open Source: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug and 2.4.6-2026-aug, and earlier versions in each listed line.
CVE-2026-103849 — Adobe Commerce: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep and 2.4.4-2026-sep, and earlier versions in each listed line.
CVE-2026-103849 — Adobe Commerce B2B: 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep and 1.3.3-2026-sep, and earlier versions in each listed line.
CVE-2026-103849 — Magento Open Source: 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep and 2.4.6-2026-sep, and earlier versions in each listed line.
Fixed in
CVE-2026-75650: Adobe hotfix VULN-39341, using the version-specific patch in Adobe's APSB26-146 installation instructions; it remains separate from September and October isolated security patches.
CVE-2026-103849 — Adobe Commerce: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct; also 2.4.10-alpha1.
CVE-2026-103849 — Adobe Commerce B2B: 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct; also 1.5.4-alpha1.
CVE-2026-103849 — Magento Open Source: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct; also 2.4.10-alpha1.
CVE
CVE-2026-75650, CVE-2026-103849
Since
4 Sept 2026

Timeline

  1. Vendor revised

    Adobe reiterated that its October isolated security patch does not contain the CVE-2026-75650 hotfix. Merchants must apply that hotfix separately.

  2. New fixPartly fixed

    Adobe released October fixes covering another critical template-engine flaw, CVE-2026-103849, and instructed merchants to install the StyleSmuggler hotfix as well. Adobe said it knew of no exploitation of the issues addressed by this October update.

  3. Vendor revised

    Adobe's updated instructions provided version-specific hotfixes for older releases as well as current ones. Adobe required rotation of the encryption key and potentially exposed credentials, including payment-provider credentials at their source.

  4. CISA added

    CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalogue, setting an 11 September remediation deadline for covered federal systems.

  5. New fixPartly fixed

    Adobe released its emergency hotfix for CVE-2026-75650 and confirmed exploitation. Adobe rated the unauthenticated code-execution flaw critical, with a CVSS score of 10.0.

  6. Made public

    Sansec publicly disclosed StyleSmuggler after reproducing the flaw on Magento Open Source 2.4.7, 2.4.8 and 2.4.9.

  7. UpdateNo fix yet

    Sansec records the first confirmed StyleSmuggler compromises. Attackers installed persistent backdoors on online-shop servers.

Sources

  1. Security update available for Adobe Commerce | APSB26-146Adobe · 7 Sept 2026
  2. Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146)Adobe · 21 Sept 2026
  3. Security update available for Adobe Commerce | APSB26-153Adobe · 13 Oct 2026
  4. Security update available for Adobe Commerce - APSB26-153Adobe · 16 Oct 2026
  5. StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attackSansec · 5 Sept 2026
  6. StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-dayTenable · 8 Sept 2026
  7. CISA Known Exploited Vulnerabilities catalogue — official data feedCISA · 3 Nov 2026
  8. Security update available for Adobe Commerce - APSB26-138Adobe · 14 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS