StyleSmuggler CVE-2026-75650: hotfix, then rotate keys

CVE-2026-75650, called StyleSmuggler, is a critical remote code execution bug in Adobe Commerce and Magento Open Source that Adobe says is exploited in the wild. Apply Adobe's hotfix VULN-39341 from bulletin APSB26-146, then follow Adobe's rotation order, starting with the encryption key. The hotfix does not remove a backdoor planted before it was applied.

Who is affected?

Any store on Adobe Commerce or Magento Open Source in the ranges above. Adobe's bulletin lists Open Source from 2.4.6, while Sansec says every version from 2.4.4 to 2.4.9 is affected. If you run Open Source 2.4.4 or 2.4.5, follow Sansec's wider range. Magento is PHP, so the separate PHP2Shell runtime flaws are a second reason to check your runtime, and how that plays out on Magento has its own page. More store-specific guides are collected under the other ecommerce guides.

Adobe's hotfix package covers the 2026-aug releases. Adobe's knowledge base says it is now compatible with 2.4.4 to 2.4.7, and lists a version-specific patch for older builds, including 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 patch levels (at our check on 28 October 2026; the page shows a last update of 21 September 2026). Pick the patch that matches your exact version.

Why is a hotfix not the end of it?

Three things catch owners.

1. The fix is a Composer patch, not a version. Your admin panel can still say 2.4.7. Confirm the patch itself. Sansec gives a command that lists applied patches, and Adobe's page describes how to apply it. A version string alone proves nothing.
2. Exploitation came first. Sansec reports unsuccessful probes on 23 August, the first confirmed exploitation on 4 September at 22:20 UTC, and Adobe's bulletin on 7 September. A store that was reachable and unpatched in that window may have been entered before you did anything wrong.
3. Patching does not clean up. Sansec says patching closes the hole but does not remove anything on a store that was already hit, and that rotating the encryption key alone does not invalidate anything an attacker already read.

A later bulletin matters too. On 13 October 2026 Adobe published APSB26-153, with October builds and a CVE-2026-103849 (CVSS 10.0, same weakness class). Adobe says it is not aware of exploits for that update, and tells merchants to apply the CVE-2026-75650 hotfix in addition to it. Sansec calls CVE-2026-103849 BlockStrap. BleepingComputer reports on 16 October that Sansec had not yet seen attacks using it, expected them, and says the September hotfix must stay in place next to the October fix. Sansec also says a plain Composer install is not enough: apply the 2026-oct release or Adobe's isolated patch. Install the October update as well.

How do I fix it?

If a host or agency manages the store

Send this and keep the reply:

For [your store], has Adobe's hotfix for CVE-2026-75650 (VULN-39341, bulletin APSB26-146) been applied, and has the October update from APSB26-153 been applied? Please give the patch status output and the date. Has anyone checked the store for compromise since 4 September, and who is rotating the encryption key and the credentials Adobe lists?

• Get the hotfix status and its date in writing
• Get the October (APSB26-153) status
• Ask who performs the rotation and when
• Rotate the credentials you hold yourself: payment gateway, shipping, tax and extension keys

If you run the server yourself

Adobe's knowledge base lists these steps in this order (checked 28 October 2026; its page shows a last update of 21 September 2026):

• Apply the hotfix for your version
• Enable maintenance mode
• Disable cron
• Rotate the encryption key
• Rotate all admin user passwords
• Deactivate and regenerate REST, SOAP and GraphQL integration tokens
• Rotate OAuth client secrets for connected third-party applications
• Rotate payment gateway API credentials at each provider
• Rotate database and Fastly credentials through a support ticket
• Rotate SSH and deploy keys, and any cron or system-privileged service account credentials
• Rotate API keys for shipping, tax and other third-party extensions
• Flush the cache
• Enable cron
• Disable maintenance mode
• On Adobe Commerce on Cloud only, redeploy to apply the new database credentials

Rotate each credential at its source, not only inside Magento. Then apply the October update from APSB26-153.

If you run 2.4.3 or older

Per Sansec, Adobe published nothing for the 2.2 and 2.3 branches or for 2.4.0 to 2.4.3, which are out of support. Scandiweb released backported patches for older releases. Sansec says it has not reviewed them and advises testing on a staging copy first. Treat a backport as a stopgap and plan a supported release; which Magento versions still get patches is laid out separately.

Am I affected? A three-state self-test

Was my store exploited before I patched?

Possibly, if it was reachable and unpatched from 4 September. Adobe says exploitation is happening, and CISA added the bug to its catalog on 8 September on evidence of active exploitation. CISA's binding directive applies only to federal civilian agencies; the catalog's own entry marks known ransomware use as unknown.

Sansec publishes indicators of compromise, including odd process names and entries in var/log/exception.log and var/report/. Compare your server against that list (the wider Magento hardening checklist helps afterwards), and run a server-side malware scan such as Sansec's eComscan, which is Sansec's own recommendation. Unfamiliar cron entries and new files are worth a look.

If you find signs of entry, patching alone is not enough. Rebuild from a known good source, then rotate everything above. Card-stealing scripts are the usual payload on a hit store, and finding a checkout skimmer is covered step by step.

What is the bug, without the exploit?

Adobe classifies it as improper neutralization of special elements used in a template engine. An unauthenticated request can lead to arbitrary code execution on the server. We do not reproduce exploit material, and you do not need it to fix the store.

What can the free scan tell me?

The free scan identifies the technologies your site serves and matches each version to known vulnerabilities. It is a lookup: it can say a version is affected, not whether your setup is exposed or whether the hotfix is installed. The full scan is $100 and sends an AI red team at what is reachable from outside.