← All postsSeptember 14, 2026

A Bad Week for Online Stores Running Magento or Adobe Commerce

Adobe shipped an emergency patch on September 7 for a flaw in Adobe Commerce and Magento Open Source, the e-commerce platform behind a large share of mid-size online stores. The bug — tracked as CVE-2026-75650 and nicknamed "StyleSmuggler" by researchers — scores a perfect 10 out of 10 on the standard severity scale. No username or password is needed to exploit it, and by the time Adobe had a fix ready, attackers were already using it.

Why this one's different

Most vulnerability disclosures follow a predictable order: someone finds a bug, reports it privately, the vendor patches it, then details go public. This wasn't that. The security firm Sansec found real attacks using this flaw in the wild starting around September 4 — three days before Adobe's patch shipped. Attackers were abusing a quirk in Magento's email-template system (the kind of thing that generates a "payment failed" notice) to smuggle in code and run it on the server, then dropping a backdoor for persistent access. That's a genuine zero-day: a live threat with no fix available yet, not a theoretical risk from an old CVE nobody patched.

What to do if you run one of these stores

  • Confirm you're patched. Adobe's fix is hotfix VULN-39341, released September 7 under its highest priority rating. If your store or your host hasn't applied it, that's today's task, not this week's.
  • Assume compromise is possible if you were exposed. Because exploitation started before the patch existed, "I patched" doesn't automatically mean "I'm clean." Look for unfamiliar admin accounts, unexpected scheduled tasks (cron jobs), and files you don't recognize in the codebase — signs reported in this specific attack included a backdoor written in Rust and a PHP web shell.
  • Don't assume a small store isn't a target. These attacks tend to be automated scans hitting every reachable Magento install, not a person manually choosing which businesses to go after. Size doesn't provide cover.
  • A web application firewall or your host's virtual patching can buy time between disclosure and a fully verified patch, but it's a stopgap, not a substitute for actually updating.

If you're not sure whether your store's platform, plugins, and hosting are current — or whether "someone" is actually checking on a schedule — that's worth confirming rather than assuming. Zero-days like this one are exactly the scenario where "we'll get to it" turns into a much longer conversation.

Sources: