CVE-2026-75650: 
PHP vulnerability analysis and mitigation

CVE-2026-75650, dubbed StyleSmuggler, is a critical Server-Side Template Injection (SSTI) vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). It allows unauthenticated remote attackers to execute arbitrary code in the context of the web server process, with scope change affecting components beyond the vulnerable application. Affected versions include Adobe Commerce 2.4.4 through 2.4.9 (August 2026 patch levels and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (August 2026 patch levels and earlier), and Magento Open Source 2.4.6 through 2.4.9 (August 2026 patch levels and earlier). Adobe disclosed and patched the vulnerability on September 7, 2026 via security bulletin APSB26-146; it was added to the CISA KEV catalog on September 8, 2026. The CVSS v3.1 base score is 10.0 (Critical) (Adobe Advisory, CISA KEV, GitHub Advisory).

The root cause is improper neutralization of user-controlled input passed to Magento's email template rendering engine (CWE-1336). Specifically, the vulnerability resides in how getProcessedTemplate() processes Magento block directives — an attacker can inject a malicious {{block class=...}} directive into a template, which causes the template engine to instantiate arbitrary PHP classes via _objectManager->create() without validating that the class implements the expected interface (e.g., GeneratorInterface). The exploit chain flows through Magento\Backend\Block\Widget\Grid\ColumnSet and Grid\Row\UrlGeneratorFactory, where a crafted template_styles array containing a payload file path and arbitrary class references (such as S3Client) bypasses type validation, ultimately causing the framework to include or evaluate attacker-controlled PHP code. The patch adds is_a() validation before object instantiation and introduces additional checks in BlockFactory and layout exception handling. No authentication or user interaction is required, and the attack is fully network-accessible (GitHub PoC, Tenable Blog, Fortbridge Research).

Successful exploitation grants an unauthenticated attacker arbitrary PHP code execution within the Magento/Adobe Commerce application context (typically as the www-data web server user), with a changed scope that can affect other system components. Attackers can read and exfiltrate sensitive data including customer PII, payment card data, and database credentials; write web shells or Rust-based backdoors for persistent access; manipulate e-commerce transactions; and pivot laterally within the application tier via ORM database access. Real-world exploitation has been confirmed to result in deployment of Rust backdoors and PHP web shells on compromised e-commerce servers, putting customer data and financial systems at direct risk (BleepingComputer, Tenable Blog, CISA KEV).

CVE-2026-75650 was exploited as a zero-day in the wild for approximately three days before Adobe released a patch on September 7, 2026. A Docker-based proof-of-concept validation lab was published on GitHub by researcher @dinosn on September 8, 2026, demonstrating PHP code execution via Magento's email template model; a separate full exploit was also published by Fortbridge. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, with a remediation due date of September 11, 2026, and CISA noted it requires forensic triage per BOD-26-04. The EPSS score is approximately 2.15% (81st percentile), and exploitation has been attributed to threat actors deploying Rust backdoors and PHP web shells against e-commerce stores; one source linked activity to the Sandworm threat group, though this attribution has not been independently confirmed. The vulnerability is automatable and requires no authentication or user interaction (CISA KEV, GitHub PoC, BleepingComputer).

1. Reconnaissance: Identify internet-facing Adobe Commerce or Magento Open Source instances using tools like Shodan, Censys, or FOFA, targeting versions at or below the August 2026 patch levels (e.g., 2.4.9, 2.4.8, 2.4.7, 2.4.6 for Magento Open Source).

2. Identify template rendering endpoint: Locate an endpoint that triggers Magento's email template rendering pipeline — a known attack vector is the failed payment email rendering flow, which processes template directives via getProcessedTemplate() without authentication.

3. Craft malicious template payload: Construct a template string containing a Magento block directive such as {{block class=Magento\\Backend\\Block\\Widget\\Grid\\ColumnSet rowUrl=$this.template_styles}} that instructs the template engine to instantiate a ColumnSet block with attacker-controlled parameters.

4. Prepare the template_styles array: Set template_styles to a crafted array with keys: 'first' pointing to an attacker-controlled PHP payload file path (e.g., in /tmp), 'second' set to DataObject::class, 'generatorClass' set to an arbitrary class (e.g., S3Client::class), and nested 'with_resolved' structures to trigger unsafe object instantiation.

5. Trigger template processing: Submit the malicious template to the vulnerable endpoint. The getProcessedTemplate() method parses the block directive, resolves ColumnSet, and passes the rowUrl parameter (sourced from template_styles) into Grid\Row\UrlGeneratorFactory.

6. Achieve arbitrary class instantiation: In the unpatched version, UrlGeneratorFactory calls _objectManager->create() with the attacker-supplied generatorClass value without is_a() validation, instantiating the arbitrary class with controlled constructor arguments.

7. Execute payload: The framework processes the 'first' key (payload file path) through BlockFactory or layout generator code, causing the PHP payload file to be included or evaluated, executing attacker-controlled code (e.g., writing a marker file, spawning a reverse shell, or dropping a web shell).

8. Establish persistence: Replace the proof-of-concept marker payload with a Rust backdoor or PHP web shell written to a web-accessible directory (e.g., pub/media/) for persistent remote access (GitHub PoC, Fortbridge Research, Tenable Blog).

• Network: Unusual HTTP POST requests to email template rendering or payment failure endpoints containing Magento block directives (e.g., {{block class=Magento\Backend\Block\Widget\Grid\ColumnSet); outbound connections from the web server process to unknown external IPs (reverse shell activity); scanning traffic from FOFA/Shodan bots targeting Magento endpoints.
• File System: Unexpected PHP files in /tmp, pub/media/, var/cache/, or other writable directories with names containing random nonces or generic names (e.g., shell.php, cmd.php); presence of Rust binaries or compiled executables in web-accessible directories; new or modified files in the Magento installation with recent timestamps inconsistent with deployment history.
• Logs: Magento application logs (var/log/exception.log, var/log/system.log) showing SSTI-related errors or unexpected class instantiation failures; web server access logs with requests to template rendering endpoints containing encoded block directives or unusual template_styles parameters; PHP error logs showing include/require of files in /tmp.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., /bin/bash, curl, wget, python, Rust binaries); unexpected cron jobs or scheduled tasks created under the web server user account.
• Artifacts: Marker files in /tmp matching the pattern /tmp/cve-2026-75650-marker-*; web shells accessible via HTTP returning command output; database entries with injected template directives in email template fields (GitHub PoC, BleepingComputer, Tenable Blog).

Adobe released security patches on September 7, 2026 via bulletin APSB26-146. Administrators should immediately update to the patched versions: Adobe Commerce 2.4.4 through 2.4.9 (apply the September 2026 security update for the respective branch), Adobe Commerce B2B 1.3.3 through 1.5.3 (apply corresponding updates), and Magento Open Source 2.4.6 through 2.4.9 (apply September 2026 updates). CISA mandated remediation for federal agencies by September 11, 2026, and also requires forensic triage per BOD-26-04 given active exploitation. As interim mitigations while patching: deploy WAF rules to detect and block template injection attempts (Cloudflare released an emergency WAF rule on September 10, 2026; Imperva also released protections); restrict access to email template rendering endpoints at the network perimeter; and audit all writable directories for unexpected files. Post-exploitation, rotate all application secrets, database credentials, and API keys, as attackers may have exfiltrated them (Adobe Advisory, CISA KEV, Tenable Blog).

The vulnerability generated significant industry attention due to its CVSS 10.0 score and confirmed zero-day exploitation. Adobe issued bulletin APSB26-146 and the Adobe Experience League published a dedicated knowledge base article. Tenable published a detailed FAQ blog post ("StyleSmuggler") and detection plugins. The Hacker News, BleepingComputer, SecurityWeek, and CSO Online all covered the story prominently, with BleepingComputer specifically reporting on Rust backdoor and PHP web shell deployments. The Australian Cyber Security Centre (ASD) issued an active exploitation warning targeting Australian e-commerce stores, and Canada's CCCS issued advisory AV26-888. Cloudflare deployed an emergency WAF rule on September 10, 2026. Community discussion on Reddit (r/SecOpsDaily, r/blueteamsec, r/linuxadmin) was active, with practitioners sharing detection and remediation guidance. Researcher @dinosn published a validation lab on GitHub within one day of the patch, and Fortbridge published a full technical write-up. One source (OpenVPN blog) attributed activity to the Sandworm threat group, though this remains unconfirmed by major vendors (BleepingComputer, Tenable Blog, SecurityWeek).