Updated Tuesday 9 September 2026. The vulnerability now has an identifier: CVE-2026-75650, with a CVSS score of 10.0, the highest possible. Adobe released a hotfix on Sunday 7 September (APSB26-146, VULN-39341) and the Dutch NCSC is telling stores to update immediately. If you run Magento or Adobe Commerce 2.4.4 up to and including 2.4.9, install the hotfix today. Below: what happened, what to do now, and how we shielded the stores we manage.
What happened
On 4 September at 22:40 UTC, security firm Sansec spotted a new attack campaign against Magento stores. Within hours the attack chain had been reproduced on clean installations. Sansec named the vulnerability StyleSmuggler and published its research on 5 September.
The core in three sentences. Without logging in, an attacker sends a request that smuggles code into Magento's template system, through the "styles" properties that existing safeguards do not check. The attacker then makes Magento build its standard "Payment Transaction Failed Reminder" email. While rendering that email, Magento executes the smuggled code. Nobody needs to open the email.
What it affects: Magento Open Source and Adobe Commerce 2.4.4 up to and including 2.4.9. The first known victim ran 2.4.6-p15 with the July and August 2026 security patches applied. The vulnerability is now registered as CVE-2026-75650 with a CVSS score of 10.0: exploitable without logging in, and without anyone having to click anything.
CVE-2026-75650: the patch and what you install
On Sunday 7 September at 20:20 UTC, Adobe published security bulletin APSB26-146 with hotfix VULN-39341. That is a standalone hotfix, not a full release, so you do not have to wait for a version upgrade. The Dutch NCSC issued its alert "Ernstige kwetsbaarheid in Adobe Commerce en Magento actief misbruikt: update onmiddellijk" the same week.
Two things to know before you install. Patching closes the hole, but it does not remove a backdoor that is already there: according to the research, attackers deployed a Rust backdoor and PHP web shells. If your store was reachable between 4 and 7 September, walk through the five steps below first and patch after that. And check whether your frontend or integrations depend on the GraphQL endpoint before you block it.
Why this will happen more often
For years, "patched" was a reasonable proxy for "secure". That is shifting, for two reasons.
First, finding and exploiting vulnerabilities has become cheaper. Writing an exploit, scanning every Magento store on the internet and running a campaign used to take specialist time. With AI tooling and cheap compute, most of that work is automated, and therefore available to far more parties.
Second, abuse now runs ahead of discovery. StyleSmuggler was already an active campaign when Sansec spotted it in the evening. The chain was reproduced the same night, and an official patch will arrive after the weekend at the earliest.
For you as a store owner, the question changes. Not only "are we patched", but "how fast do we notice, and who steps in".
What to do this weekend
Five steps, in this order. If you have a maintenance partner, forward this and ask for confirmation per item. Want us to take a look? Request the free security check, we do four per month.
- Block GraphQL temporarily if you do not use it. The observed attacks go through the /graphql endpoint. If you run a Hyvä or Luma frontend without headless integrations or a PWA, you can block that endpoint at the web server or firewall level until an official fix is available. If you do use GraphQL, this option is off the table and steps 2 to 5 carry more weight.
- Check for the known indicators. Sansec published domains, IP addresses, a process name and file paths tied to this campaign. Have your administrator compare that list against the server: outbound traffic, running processes and the Magento user's home directory.
- Scan for implants. A malware scan of the codebase and the database, not only the files Magento manages itself.
- Rotate credentials if you find anything. Admin accounts, API keys, the database password and integration tokens. A backdoor that is already running may have read them.
- Install hotfix VULN-39341 (APSB26-146). It has been available since 7 September and closes CVE-2026-75650. Do this after checking for indicators, not before: a patch closes the front door, but leaves a backdoor that is already inside untouched.
How we handled this for the stores we manage
On Saturday, within a day of the research being published, our team patched every store under management against this attack chain. Without waiting for Adobe's official release. That is how our maintenance is set up: we assess every security advisory within 48 hours of publication, and when exploitation is active we do not wait for office hours.
On top of that, every managed store runs a combination of our own monitoring, external scanning for known malware patterns and a firewall layer in front of web traffic. Unusual behaviour usually shows up before a client reports it.
What this means for your maintenance
The market norm is to patch when there is time, and to resolve incidents at an hourly rate when they occur. That worked when attacks were rare and slow.
Vendic Guard is the standalone protection package for stores that want it differently: availability from 07:00 to 23:00, seven days a week, a response within 60 minutes, and bot attacks that we detect and resolve, inside and outside office hours. If you are already on Vendic Pulse, our maintenance package, Guard is included.
Want to know where your store stands first? Request the free security check: an external scan of patch level, exposure and known indicators, with a report in management language. Four per month, no strings attached. Then this weekend is one thing less to worry about.
Sources: Sansec, "StyleSmuggler", 5 September 2026, updated with CVE-2026-75650: sansec.io/research/stylesmuggler-0day. Adobe security bulletin APSB26-146, 7 September 2026. NCSC (NL), "Ernstige kwetsbaarheid in Adobe Commerce en Magento actief misbruikt: update onmiddellijk": ncsc.nl.
