Adobe escalated its warning on September 21 about CVE-2026-75650, a vulnerability carrying the maximum possible CVSS score of 10.0 that lets an unauthenticated attacker run code on your store's server. Attacks began September 4, three days before a patch existed.

If you run Adobe Commerce or Magento Open Source, the critical point is this: applying the hotfix stops new attacks through this flaw. It does not remove a backdoor installed during the exploitation window, and it does not invalidate credentials an attacker already copied.

Which Versions Are Affected by CVE-2026-75650

Every version from 2.4.4 through 2.4.9 is affected, including Adobe Commerce, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source. Adobe's bulletin specifically names 2.4.9-2026-aug and earlier as vulnerable.

That range matters because fully patched, current stores were compromised. The usual advice to keep software updated didn't protect anyone during the roughly 70 hours before Adobe shipped the fix.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 8, requiring federal agencies to patch by September 11.

How the StyleSmuggler Attack Works

The exploit runs in two stages. An attacker sends a request to Magento's GraphQL endpoint with malicious PHP hidden inside an HTTP header or parameter. Magento logs the unrecognized value, writing the attacker's code to a server-side file as part of normal operations.

The code then executes when the store renders a “Payment Transaction Failed Reminder” email.

No login required, no user interaction. Akamai confirmed active exploitation and notes the attack abuses Magento's own template-processing and dependency-injection code.

One practical detection signal: an unexpected burst of failed-payment reminder emails is worth investigating, though legitimate card declines produce the same message.

How Widespread the Exploitation Is

CrowdSec recorded 2,760 signals matching the exploitation pattern between September 9 and 13, averaging 552 per day and peaking at 1,303 on September 11. Its tracker counted 500 unique attacking IP addresses as of September 14, with sources spread across the United States, Singapore, Indonesia, the Netherlands, and Cambodia.

Sansec observed multiple unrelated threat actors with rapidly evolving payloads. In some cases, two distinct groups placed different backdoors on the same store. Observed implants include a Rust-based Linux backdoor that hides as a system process and beacons out over traffic disguised as time-sync, plus PHP web shells.

How to Apply Adobe's Hotfix Correctly

The fix ships as a hotfix, not a full release. Download VULN-39341-composer-patches.zip from repo.magento.com and apply it as a composer patch.

Verify installation rather than assuming it worked. Sansec's documented check:

vendor/bin/magento-patches -n status | grep "39341\|Status"

Match your version and patch level against Adobe's current table rather than following a patch referenced in a forum post.

What Credentials Adobe Says to Rotate

Adobe's September 21 guidance goes well beyond the encryption key. That key protects integration tokens, payment gateway credentials, and privileged automation secrets, so rotating it alone doesn't invalidate what was already exposed.

Adobe's rotation list covers admin passwords, REST, SOAP and GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, Fastly credentials, SSH and deploy keys, service-account credentials, and keys used by shipping and tax extensions.

Sequence matters. Patch first, then enter maintenance mode, then rotate. Rotating a payment secret before closing the vulnerability means an attacker can capture the new one too.

Assign one owner to the rotation plan and log each credential, the external provider, the internal dependency, who made the change, what test confirmed it, and when it completed.

What to Test After Credential Rotation

Rotation breaks stores in ways a homepage check won't catch. Place controlled orders using your highest-volume payment methods and confirm authorization, capture, tax calculation, fraud screening, confirmation email, warehouse handoff, shipment update, refund, and reconciliation.

Check every integration that authenticates separately. A carrier label can work while a returns portal, ERP export, or subscription rebill fails silently. Watch decline rates, checkout abandonment, webhook errors, and order queues against your normal baseline.

Preserve web, application, payment, and infrastructure logs before retention policies delete them. Record when the patch was installed and when each credential changed.

What to Do This Week

Inventory every Adobe Commerce and Magento installation you run, including staging environments and forgotten regional stores. Compare each against Adobe's patch matrix, apply the hotfix, and verify it reports as applied.

Then scan for compromise rather than assuming the patch was enough. Stores running during the September 4 to 7 window need incident response, not just a patch. Have your response team check for unauthorized files, processes, scheduled jobs, integrations, admin users, and changes to checkout code.

This incident may prompt a longer conversation about who owns platform maintenance, and whether a hosted platform makes more sense than self-managed infrastructure. That's a reasonable question to revisit later. It isn't a containment step, and it shouldn't delay anything above.