Security notice
Adobe Commerce and Magento stores under active attack
CVE-2026-75650 scores a full 10.0 and lets an attacker run code on an Adobe Commerce or Magento Open Source store without logging in. It was exploited before a patch existed, Adobe has since shipped one, and the ASD says a substantial number of potentially vulnerable instances are in Australia. If you run one of these stores, patch it today.
What's happening
A vulnerability in Adobe Commerce and Magento Open Source, tracked as CVE-2026-75650, scores 10.0 out of 10. It is an injection flaw in the platform's template engine, and it lets an attacker who has never logged in run their own code on the server. There is no account to guess and no setting to get wrong. If the store is reachable and unpatched, it is exploitable.
The Dutch security firm Sansec disclosed it on 5 September 2026 and named it StyleSmuggler. Attacks were already underway by then, with exploitation observed from 4 September, so store owners had no patch to apply for the first few days. Adobe has since published the fix as bulletin APSB26-146.
On compromised stores, attackers have installed a Rust based Linux backdoor and a PHP dropper that writes a web shell, which gives them a way back in that survives the patch. Patching alone does not undo a break-in that already happened.
The reason this one has an Australian advisory attached is scale. The ASD's ACSC says it is aware of a substantial number of potentially vulnerable instances in Australia and is telling organisations to patch as soon as possible.
You can read the original advisory on the ASD's Cyber.gov.au site.
Who is at risk
- Any unpatched Adobe Commerce or Magento Open Source store. The flaw reaches current releases, including the 2.4.9 line, so being on the newest version before the fix is no protection.
- Stores that were online between 4 September and the day you applied the patch. That window is the one that matters, because exploitation started before the fix existed.
- Stores someone else manages. If a developer, agency or host looks after the platform, the patch is their job and the risk is still yours.
- Stores with no file integrity monitoring. A web shell dropped into the file system is invisible from the admin dashboard.
What to do if you run one of these stores
- Apply Adobe's APSB26-146 update now. Treat it as urgent rather than as part of the next maintenance window.
- If someone else manages the platform, contact them today and get written confirmation of the version you are running and the date it was patched.
- Assume the store may already have been reached. Check the file system for files you did not put there, particularly PHP files in upload and media directories, and look for unexpected outbound connections from the server.
- Review administrator accounts and remove any you do not recognise. A backdoor is often paired with a new admin user.
- Rotate administrator passwords, API keys and integration credentials, and turn on multi-factor authentication on every account that will take it.
- Check payment and checkout templates for injected scripts. Card skimming is the usual commercial motive for taking over a store.
- Confirm you have a restorable backup taken before 4 September, so you have something clean to compare against or fall back to.
How this affects our clients
It does not. We do not build or manage Adobe Commerce or Magento stores, and no site we look after runs on either platform. We are publishing this because the ASD says a substantial number of vulnerable stores are Australian, and some of the people who read these notices will own one or know someone who does.
The wider point is the one we keep making. A platform with a large amount of server side code, a plugin ecosystem and an admin login exposed to the internet gives an attacker somewhere to aim. This flaw needed no password and no misconfiguration, only a reachable store. Jigsaw sites have no such runtime to exploit, which is the whole reason we build that way.
If you run a store on one of these platforms and want a second opinion on whether it has been touched, request a chat. We will tell you honestly if it is outside what we do.
