Skip to content
OpenAdvisories
Critical · 10.0 Known exploited Scanner template Public exploit CVE-2026-75650 EUVD-2026-72530GHSA-fj37-xm58-mf28

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Published Sep 7, 2026 · Updated Sep 9, 2026 · Assigned by adobe

Vendor: Adobe Product: Adobe Commerce Product: Adobe Commerce B2B Product: Magento Open Source Category: Web / CMS

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Affected products

VendorProductAffectedFixed
Adobe Adobe Commerce ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug Hotfix for CVE-2026-7565
Adobe Adobe Commerce B2B ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug Hotfix for CVE-2026-7565
Adobe Magento Open Source ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug Hotfix for CVE-2026-7565

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 7 repositories

  • fortbridge/stylesmuggler ★ 8 · Sep 12, 2026

    Private HTTP-only reproduction of CVE-2026-75650 StyleSmuggler

  • dinosn/cve-2026-75650-magento-validation-lab ★ 7 · Sep 8, 2026

    Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.

  • disrex-group/stylesmuggler-adobe-patches ★ 5 · Sep 8, 2026

    composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.

  • basesixtythree/B63-POC-CVE-2026-75650 ★ 0 · Oct 26, 2026

    CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test

  • abraxas/CVE-2026-75650 ★ 0 · Sep 26, 2026

    CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)

  • disrex-group/stylesmuggler-adobe-patches-mageos ★ 0 · Sep 8, 2026

    composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).

  • jithinkrishnanrs/stylesmuggler-ioc-toolkit ★ 0 · Sep 7, 2026

    StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of comprom…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 5

References