magento and adobe commerce zero-day used to backdoor online stores

what happened

• Adobe published bulletin APSB26-146, Priority 1, on September 7, 2026 for CVE-2026-75650, an improper-neutralization flaw in a template engine (CWE-1336) that leads to arbitrary code execution, rated CVSS 10.0 with no authentication required.[1,2]
• Adobe states it is aware of CVE-2026-75650 being exploited in the wild.[1]
• Affected releases are Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3 and Magento Open Source 2.4.6–2.4.9, including all "2026-aug and earlier" builds.[1]
• CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on 2026-09-08 with a 2026-09-11 due date.[3,2]
• Sansec, which discovered and named the flaw StyleSmuggler, said exploitation began on September 4, with the first confirmed compromise at 22:20 UTC, about three days before Adobe shipped a hotfix, according to iTnews and BleepingComputer.[4,5]
• BleepingComputer reported that the backdoor disguised its command-and-control host as an NTP server, that a second attacker used the flaw to deploy a 485-byte PHP web shell, and that compromised hosts may show "Payment Transaction Failed Reminder" emails.[4]
• iTnews reported that Australia's ACSC said exploitation requires the /graphql endpoint to be exposed and that it is aware of "a substantial number of potentially vulnerable instances" in Australia.[5]
• BleepingComputer reported that Adobe recommends installing hotfix VULN-39341 and says the hotfix has only been tested against the August 2026 releases of the affected branches.[4]