When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650

Opening

CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler, documented exploitation starting 4 September 2026. Adobe published the emergency hotfix VULN-39341 on 7 September 2026 under advisory APSB26-146.
The relevant window is those three days. A store that was compromised before the hotfix did not become safe by applying it.

Technical context

The flaw is classified as CWE-1336, improper neutralization of special elements used in a template engine. The affected version range covers Adobe Commerce 2.4.4 through 2.4.9 (through the 2026-aug builds), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Stores that applied the August 2026 monthly patch remained vulnerable, which is why the hotfix was distributed separately.
Adobe assigned a CVSS 10.0 to the flaw. The attack requires no authentication and no user interaction.

How the attack chain works

Public analyses from Sansec and the Fortbridge proof-of-concept repository describe the sequence consistently:

1. The attacker places crafted, poisoned data where Magento generates its own records - error reports and payment transaction data.
2. The attacker triggers the standard "Payment Transaction Failed Reminder" email. Rendering that template is the exploit moment: the template engine processes the poisoned data with inadequate neutralization.
3. Through an object-injection chain into Magento's dependency-injection container, the processed data is included and executed as PHP with web-server privileges.
4. Observed payloads include a Rust backdoor disguised as kernel-thread and system processes such as [kworker/u:8:0], fc-cache, or chronyd, communicating over UDP 123 disguised as NTP traffic, and small PHP web shells written into media directories. One detail matters for detection: a burst of "payment failed" notification emails without matching failed orders is a reasonable early indicator, because the exploit ride on the same rendering path.

Defensive implications

Patching closes the flaw but does not evict an intruder. The post-compromise checklist from the primary sources is concrete:

• Inspect pub/media for PHP files that do not belong there.
• Check running processes for names imitating kernel threads and font or time services, and watch for egress to UDP 123.
• Rotate credentials in a specific order: encryption keys first, because they protect everything else, then admin passwords, API tokens (REST, GraphQL, SOAP), payment gateway credentials, database accounts, and SSH keys.
• Run a targeted scanner such as Sansec's eComscan, which identifies the Rust backdoor and secondary web shells. For EOL versions such as 2.4.0-2.4.3, only community backports exist; they are unverified by Adobe and require staging validation before production use. The StyleSmuggler case is a reminder that transactional email rendering is code execution in waiting. Treat "the store sends email" as an attack surface, not plumbing.

References

• Adobe Security Bulletin APSB26-146 and hotfix VULN-39341
• Sansec research on StyleSmuggler exploitation and detection
• CISA KEV catalog entry added 8 September 2026
• Fortbridge StyleSmuggler proof-of-concept repository
• Disrex incident timeline (first exploitation confirmed 4 September 2026 at 22:20 UTC; compromise observed 50 minutes later)