Adobe ships a CVSS 10 Magento hotfix. Patching without key rotation is not remediation.

APSB26-146 assigns CVE-2026-75650 to StyleSmuggler, confirms in-the-wild exploitation, and tells merchants to apply VULN-39341 and rotate every credential the encryption key protected.

RWP Ventures · 2026-09-08 · event 2026-09-07 · 10 min read · priority 8.5

This is a material development from [yesterday’s Daily Top](/posts/2026-09-07-stylesmuggler-magento-adobe-commerce-unpatched-rce/), which recorded no Adobe CVE, bulletin, or patch. The hole now has a vendor lever. The operational problem has not closed: Sansec’s last update on 7 September 20:45 UTC documented three days of exploitation, two distinct payload operators, and an implant that renamed itself twice and moved C2 onto NTP-shaped UDP.

CISA had not added CVE-2026-75650 to the Known Exploited Vulnerabilities catalog as of this writing. That absence does not change priority for anyone running Magento.

What happened

Dutch e-commerce security firm Sansec published on 5 September that an unauthenticated RCE chain, which it named StyleSmuggler, was being used against current Magento 2.4.x. First confirmed exploitation: 4 September 22:20 UTC. Sansec reproduced the chain on clean 2.4.7, 2.4.8 and 2.4.9 installs. One victim was on 2.4.6-p15 with July and August 2026 patches applied and a clean security:patch-status.

Adobe’s bulletin, last updated 7 September, classifies the defect as improper neutralization of special elements used in a template engine. Authentication required: No. Impact: arbitrary code execution. Scope: changed. Adobe Commerce 2.4.4 through 2.4.9 (2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9 are listed as affected. The hotfix was tested against the 2026-aug trains; Adobe notes it may work on other supported versions but has not officially verified them.

The Experience League article is the operational document. Merchants on cloud, on-premises, and Magento Open Source are told to:

1. Apply VULN-39341-composer-patches.zip from repo.magento.com.
2. Confirm Applied status with vendor/bin/magento-patches -n status | grep "39341\|Status" (cloud merchants).
3. Enter maintenance mode, disable cron, rotate the encryption key, then rotate the credential set listed above at each upstream provider.
4. Flush cache, re-enable cron, leave maintenance mode.

Sansec’s 7 September 20:45 UTC update aligns with Adobe on the CVE and the hotfix, and adds what Adobe does not: payload behavior. A small Rust implant was observed as [kworker/u:8:0], then fc-cache under ~/.cache/fontconfig/, then chronyd under /tmp/.chrony-<8hex>/. Later builds beacon over UDP/123 using hostnames that look like time-sync infrastructure (ntp.timesync.to, ntp.timesysnc.net, fallbacks ntp.synctime.to / ntp.syncstime.to). A second, unrelated operator dropped a 485-byte PHP dropper that writes a web shell under pub/media/catalog/product/cache/. The Hacker News independently reported the Adobe patch, the Rust implant, the PHP web shell, and a Disrex observation that one managed Magento server was compromised about 50 minutes after the first confirmed exploitation.

RWP is not reproducing request bodies, GraphQL field names beyond what Sansec already published, or a gadget map. Those details are not required to prioritize defense.

Why it matters

Yesterday the defender problem was “no official patch.” Today it is “a patch exists and most stores that were internet-facing on 4–7 September should be treated as possibly already read.” Adobe’s rotation checklist is the tell. The encryption key protects integration tokens and payment-gateway credentials. Rotating the key without rotating those credentials at Stripe, Braintree, Adyen, PayPal, and every other connected service leaves the attacker holding live secrets.

Two operators in three days is the expected Magento pattern after a public pre-auth RCE: the first campaign does not stay exclusive. The implant’s shift from TLS/WebSocket C2 to NTP-shaped UDP is persistence tradecraft aimed at egress filters, not a skimmer overlay. Card-skimming on the same foothold remains a plausible next step; it is not CONFIRMED in the sources reviewed for this assessment.

For industrial and critical-infrastructure organizations the OT implication is indirect and should be stated that way. Magento is not a controller. It is often the customer-facing and payments-adjacent system sitting on the same identity, DNS, and hosting estate as plant-adjacent IT. A Linux userland implant plus stolen payment API keys is an enterprise incident that can cascade into ERP and order-to-cash, not a confirmed process-manipulation event.

Who / what is affected

Internet-facing GraphQL and the payment-email rendering path remain the practical exposure. Sansec’s earlier “disable GraphQL” workaround is no longer the primary control once VULN-39341 is applied and verified. It is still a reasonable temporary brake on unpatched hosts.

Technical context

CWE-1336 (template-engine injection) plus Magento’s object-manager / template-filter path is enough context for a defender. Sansec describes a two-stage sequence: attacker-controlled content is injected into the template system (Sansec cites styles properties as the evasion path), then Magento executes the poisoned content while rendering a “Payment Transaction Failed Reminder” email. Nobody has to open the message. The attack can succeed if delivery fails.

ATT&CK mapping for the observed follow-on, not the initial RCE itself:

• Initial access: exploit public-facing application (T1190)
• Execution: command and scripting interpreter / native binary (T1059)
• Persistence: cron (T1053.003); masquerading as kworker / fc-cache / chronyd (T1036)
• Command and control: WebSocket over TLS on early builds; application-layer protocol over UDP/123 on later builds (T1071, T1571)
• Defense evasion: rename to look like a time daemon so UDP/123 allow-lists hide the beacon (T1036.004)

This is not a how-to. Hunt from the public indicators Sansec already published.

Threat / exploitation status

High confidence on existence, exploitation, affected trains, and the vendor hotfix. Moderate confidence that a non-trivial fraction of internet-facing stores were hit in the 4–7 September window (Sansec has a large scan net; public counts are not a census). Low confidence on remaining unpatched population after the hotfix drop.

What defenders should do

Do not treat “we applied VULN-39341” as incident closure.

1. Apply Adobe’s VULN-39341 composer hotfix for your exact train. Confirm Applied status. Cloud merchants follow the Experience League verification command; on-premises merchants should still grep patch status and not assume a zip download equaled a successful apply.
2. Execute Adobe’s rotation sequence in order: maintenance mode, cron off, encryption-key rotation, then rotate every credential at the source. Payment-gateway keys first. Integration tokens second. SSH/deploy keys and database credentials third. Flush cache last.
3. Hunt before you declare clean. Sansec’s public process and path indicators: [kworker/u:8:0], ~/.cache/fontconfig/fc-cache, /tmp/.chrony-<8hex>/chronyd, cron lines written straight into the spool (so crontab -l can lie), PHP under pub/media, and unexpected bursts of “Payment Transaction Failed Reminder” generation from 4 September onward. Empty crontab is not evidence of cleanliness; Sansec observed a chronyd build that relaunched with no cron entry.
4. Egress: treat UDP/123 to non-organizational NTP as suspicious when the process is not a packaged chronyd. Sansec reported 185.157.160.251 as the 7 September A record for ntp.timesync.to / ntp.timesysnc.net. Early C2 also used 99.84.67.186:443 (WebSocket over TLS). Block and hunt; do not treat a block as a forensic pass.
5. If GraphQL is still disabled from yesterday’s workaround, leave it off until the hotfix is verified, then restore it as a controlled change — not as proof of safety.
6. WAF and commercial Magento shields are containment. They do not rotate payment keys.

This is not a step-by-step exploit guide. Use Adobe’s KB and Sansec’s advisory for the mechanical walkthrough those vendors already published.

RWP assessment

Score 8.5. Active exploitation, vendor-confirmed, CVSS 10, payment-adjacent, and a remediation path that most Magento operators will under-execute if they stop at the composer patch. It is a point below yesterday’s 8.7 only because a Priority 1 hotfix now exists. It stays Daily Top because the new vendor mitigation is exactly the material development the doctrine requires, and because Adobe’s own language implies secrets exposure, not just a code bug.

It outranks today’s other credible developments:

• Microsoft September 2026 Early Security Updates (released 8 September): 11 Microsoft CVEs, including two CVSS 10.0 cloud identity/AI defects (CVE-2026-83711 Azure AD B2C authorization bypass; CVE-2026-70352 Azure AI Language missing authentication) plus Entra ID CVE-2026-83941 (9.9) and CVE-2026-62916 (9.1). Microsoft states these have already been fully mitigated at the service and require no customer action. None are marked exploited. Decision-useful for identity owners reviewing Entra/B2C/Copilot Studio exposure; not today’s highest-urgency action item. Score 6.4.
• N-able N-central CVE-2026-86218 (HF4, 6–7 September): pre-auth RCE, CVSS 10, fourth hotfix in five weeks, mixed public vs customer messaging on exploitation. Already weighed yesterday; a vendor hotfix exists. Score 7.3 as a continuing MSP-stack problem, not a new primary.
• Chrome V8 CVE-2026-85046: CISA KEV 4 September, due 18 September, fixed in 152.0.7977.82. Still patch-now for endpoints. Not today’s top because a vendor build already exists.

What we are watching

• Whether CISA adds CVE-2026-75650 to KEV, and whether BOD 26-04 forensic-triage flags apply.
• Adobe’s 8 September scheduled Commerce bulletin: whether VULN-39341 is folded into the regular drop or remains a one-off hotfix, and whether older unverified trains get a tested patch.
• Implant C2 evolution past NTP mimicry, and whether card-skimming overlays appear on the same hosts.
• Copycat operators beyond the two Sansec has already separated.
• Magento-adjacent MSP and hosting providers that patch the CMS but do not rotate customer payment keys.

Sources

• Adobe APSB26-146
• Adobe Experience League — APSB26-146 hotfix and credential rotation
• Sansec StyleSmuggler advisory (CVE-2026-75650)
• The Hacker News — Adobe patch, Rust backdoor, PHP web shell
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft September 2026 Early Security Updates
• [RWP Daily Top, 7 September 2026 — unpatched StyleSmuggler](/posts/2026-09-07-stylesmuggler-magento-adobe-commerce-unpatched-rce/)