ADOBE has released an emergency hotfix for a critical flaw in Adobe Commerce and Magento, tracked as CVE-2026-75650, with a CVSS score of 10.0. The vulnerability, also known by researchers as StyleSmuggler, enables unauthenticated attackers to achieve arbitrary code execution and has been exploited in the wild. Adobe notes the patch fixes the issue in the hotfix for CVE-2026-7565, and security researchers report that fully patched stores were still compromised in demonstrations of the attack chain.
The flaw is a template-engine injection (CWE-1336) in Adobe Commerce and Magento Open Source, affecting versions from 2.4.4 through 2.4.9 and various 1.3.x–1.5.x releases of the B2B line. The exploitation operates without login or user interaction. Sansec has shown a two-stage process: first, the attacker poisons PHP code (often via a generated failure report), then Magento executes that code as it renders a failed-payment email, with the attack capable of succeeding even if the recipient does not open the email.
In live campaigns, operators reportedly rotated payloads multiple times daily, and a second actor used the same flaw to deploy a web shell. Organisations are advised to apply Adobe’s hotfix immediately, follow the APSB26-146 guidance for installation, and scan for compromise, including rotating encryption keys and credentials that may have been exposed.