Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Ravie LakshmananSep 08, 2026Vulnerability / Web Security

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.

The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.

“This update resolves a critical vulnerability that could result in arbitrary code execution,” Adobe said, adding it’s “aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants.”

At its core, the flaw abuses Magento’s template system through PHP code injection to generate a “Payment Transaction Failed Reminder” email, triggering code execution in the process.

“To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys,” Adobe said.

The development comes days after the Dutch e-commerce security company revealed that threat actors are exploiting CVE-2026-75650 to deploy a Rust-based Linux backdoor that connects to an external server and awaits further instructions. Separately, the issue has been abused to deliver a PHP dropper on susceptible sites that writes a web shell capable of executing arbitrary PHP code.

According to Netherlands-based Disrex, a Magento server managed by the e-commerce development platform is said to have been compromised 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026, at 10:20 p.m. UTC.

“StyleSmuggler turns Magento’s own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain,” Disrex said.