CVE-2026-75650: 
PHP vulnerability analysis and mitigation

CVE-2026-75650, dubbed StyleSmuggler, is a Server-Side Template Injection (SSTI) vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). It allows unauthenticated remote attackers to execute arbitrary code in the context of the web server process, with scope change affecting components beyond the vulnerable system. Affected versions include Adobe Commerce 2.4.4 through 2.4.9 (August 2026 patch levels and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (August 2026 patch levels and earlier), and Magento Open Source 2.4.6 through 2.4.9 (August 2026 patch levels and earlier). Adobe disclosed and patched the vulnerability on September 7, 2026 via security bulletin APSB26-146, after it had already been exploited in the wild for approximately three days as a zero-day. It carries a maximum CVSS v3.1 base score of 10.0 (Critical) (Adobe Advisory, GitHub Advisory, CISA KEV).

The root cause is improper neutralization of special elements in Magento's email template engine (CWE-1336). The exploit chains SSTI in Magento's email template rendering with unsafe object instantiation in Backend/Model/Widget/Grid/Row/UrlGeneratorFactory. An attacker crafts a malicious Magento block directive — e.g., {{block class=Magento\Backend\Block\Widget\Grid\ColumnSet rowUrl=$this.template_styles}} — and injects it into a template's text via setTemplateText(). The setTemplateStyles() method is then passed a crafted array containing a payload file path and arbitrary class references (including generatorClass); in the vulnerable code path, UrlGeneratorFactory calls _objectManager->create() with the attacker-controlled class name without validating it against GeneratorInterface via is_a(). This allows instantiation of arbitrary PHP classes and ultimately inclusion or evaluation of attacker-controlled PHP files. The patch adds is_a() validation in UrlGeneratorFactory and a BlockFactory precheck. No authentication or user interaction is required, and the attack is fully network-accessible (GitHub Advisory, Feedly/PoC Analysis, Tenable Blog).

Successful exploitation grants an unauthenticated attacker arbitrary PHP code execution within the Magento application context (typically as the www-data web server user), with a changed scope that can affect other system components. Attackers have been observed deploying Rust-based backdoors and PHP web shells on compromised e-commerce servers, enabling persistent access, database credential theft, customer payment data exfiltration, and lateral movement within the application tier. The availability, integrity, and confidentiality impacts are all rated High, making this a full-compromise scenario for any exposed Adobe Commerce or Magento instance (BleepingComputer, Tenable Blog, CISA KEV).

CVE-2026-75650 was actively exploited as a zero-day for approximately three days before Adobe's patch was released on September 7, 2026. A Docker-based proof-of-concept validation lab was published on GitHub by dinosn on September 8, 2026, demonstrating PHP code execution via Magento's email template model (PoC GitHub). CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, with a remediation due date of September 11, 2026, and noted it requires forensic triage per BOD-26-04 (CISA KEV). The vulnerability is fully automatable (no authentication, no user interaction required), and the NVD SSVC assessment confirms active exploitation with total technical impact. The EPSS score is approximately 2.15% (81st percentile), and Qualys scanner detection (ID 735532) is available. Threat actors have deployed Rust backdoors and PHP web shells against online stores; no specific APT attribution has been publicly confirmed (BleepingComputer, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Adobe Commerce or Magento Open Source instances using tools like Shodan, Censys, or FOFA, targeting versions up to the August 2026 patch level (e.g., 2.4.9, 2.4.8, 2.4.7, 2.4.6 without the September 2026 hotfix).

2. Prepare payload file: Create a PHP payload file (e.g., in /tmp/payload-{nonce}.php) containing attacker-controlled code — in the PoC, this writes a marker file to /tmp to prove execution; in a real attack, this would be a web shell or reverse shell.

3. Craft malicious template: Construct a Magento email template string containing the SSTI block directive:

   {{block class=Magento\\Backend\\Block\\Widget\\Grid\\ColumnSet rowUrl=$this.template_styles}}

   Instantiate a Magento Email Template object and call setTemplateText() with this directive.

4. Inject malicious template_styles array: Call setTemplateStyles() with a crafted array:

   [
     'first' => '/tmp/payload-{nonce}.php',
     'second' => DataObject::class,
     'generatorClass' => SomeArbitraryClass::class,
     'with_resolved' => [...]
   ]

   This array is passed through to UrlGeneratorFactory without type validation in the vulnerable version.

5. Trigger template rendering: Call getProcessedTemplate() on the email template object. The template engine parses the block directive, resolves ColumnSet, and during instantiation, UrlGeneratorFactory calls _objectManager->create() with the attacker-controlled generatorClass without is_a() validation.

6. Achieve code execution: The framework's BlockFactory or layout generator includes or evaluates the payload file path from the first key, executing the attacker's PHP code in the Magento application context.

7. Establish persistence: Replace the marker payload with a PHP web shell (e.g., dropped into pub/media/ or another web-accessible directory) or deploy a Rust-based backdoor for persistent access, credential harvesting, and lateral movement (PoC GitHub, BleepingComputer, Tenable Blog).

• Network: Unusual HTTP POST requests to Magento email template rendering endpoints (e.g., payment failure notification paths); outbound connections from the web server to unknown external IPs; anomalous GraphQL API requests that may be used as a precondition for template injection.
• File System: Unexpected PHP files in /tmp/, pub/media/, var/log/, or other writable directories with names matching patterns like cve-2026-75650-marker-* or random nonce strings; new or modified files in Magento's app/code/ or vendor/ directories; Rust binaries or unfamiliar ELF executables in web-accessible paths.
• Logs: Magento application logs (var/log/exception.log, var/log/system.log) showing errors related to UrlGeneratorFactory, ColumnSet block instantiation, or getProcessedTemplate() calls with unexpected class names; web server access logs showing requests to email template rendering endpoints with encoded or unusual parameters.
• Process: Unexpected child processes spawned by the PHP-FPM or Apache/Nginx worker (e.g., /bin/bash, curl, wget, python, or Rust binaries); new cron jobs or systemd services created by the web server user (www-data).
• Persistence Artifacts: PHP web shells with obfuscated content in web-accessible directories; Rust backdoor binaries with unusual names; new admin accounts or API tokens created in the Magento database (BleepingComputer, Tenable Blog, PoC GitHub).

Adobe released security patches on September 7, 2026 via bulletin APSB26-146. Administrators should immediately apply the September 2026 security updates for their respective product lines:

• Adobe Commerce: Update to the September 2026 patch for versions 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, or 2.4.9.
• Adobe Commerce B2B: Update to the September 2026 patch for versions 1.3.3, 1.3.4, 1.4.2, 1.5.2, or 1.5.3.
• Magento Open Source: Apply the September 2026 patch for versions 2.4.6, 2.4.7, 2.4.8, or 2.4.9.

CISA's due date for federal agencies was September 11, 2026, and forensic triage is required per BOD-26-04 for any systems that may have been exposed. As interim mitigations, deploy WAF rules to detect and block template injection directives (Cloudflare released an emergency WAF rule on September 10, 2026; Imperva and Fastly also published protections). After patching, rotate all API keys, database credentials, and admin passwords, and audit for web shells or backdoors. Community Magento patches (e.g., disrex/stylesmuggler-adobe-patches) are available for environments unable to immediately apply official updates (Adobe Advisory, CISA KEV, GitHub Advisory).

Adobe's patch release on September 7, 2026 was widely covered as a critical emergency, with BleepingComputer, The Hacker News, SecurityWeek, and CSO Online all reporting active exploitation and the deployment of Rust backdoors and PHP web shells against e-commerce stores (BleepingComputer, The Hacker News, SecurityWeek). Tenable published a detailed FAQ blog post on StyleSmuggler, and Red Eye Security, Fortbridge, Akamai, and NetSPI all released technical analyses of the exploit chain (Tenable Blog, Fortbridge Research). The Australian Cyber Security Centre (ASD) and Canadian Centre for Cyber Security (CCCS) issued active exploitation warnings, and CISA added the CVE to its KEV catalog the day after disclosure. Community reaction on Reddit and Mastodon was urgent, with Magento store operators and security professionals calling for immediate patching; some researchers noted that patching alone may be insufficient if stores were already compromised, emphasizing the need for credential rotation and forensic investigation (CISA KEV, Cyber.gov.au).