Adobe published emergency hotfix APSB26-146 on 7 September 2026 at 20:20 UTC, closing CVE-2026-75650 (StyleSmuggler) across Adobe Commerce 2.4.4 through 2.4.9. The patch is available. The exploitation campaign is not over. And for every store compromised during the 72-hour window before the hotfix existed, patching is only the beginning.
As Tenable's FAQ states clearly: "Patching alone does not remediate an existing compromise." As Sansec updated on their advisory page: "Patching closes the hole but does not clean a store that was already hit. Stores were being exploited for three days before the hotfix existed, so scan before you assume you are in the clear."
CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalogue on 8 September. Between 9 and 13 September, CrowdSec's network recorded 2,760 signals from machines reporting exploitation attempts, peaking at 1,303 signals in a single day on 11 September from 193 distinct sources. As of 14 September, 500 unique attack source IPs have been tracked.
The campaign has not ended. It has evolved.
What patching does and does not do
The VULN-39341 hotfix closes the template injection vulnerability that StyleSmuggler exploits. New attacks using the original StyleSmuggler chain can no longer succeed on patched stores.
What patching does not do:
-
Remove backdoors already installed on compromised stores
-
Revoke credentials already stolen during the exploitation window
-
Delete PHP web shells placed in the product image cache or media directory
-
Disconnect active command-and-control connections
eSecurity Planet's analysis confirms: "Adobe directs merchants to rotate not only Commerce encryption keys but also passwords, tokens, payment credentials, database credentials, and other secrets that attackers may have accessed." Critically, Adobe's September 2026 Commerce security release does not replace the hotfix. In APSB26-138, Adobe specifically tells customers to apply the CVE-2026-75650 hotfix in addition to the September security updates. Both are required.
Sansec has observed several implant variants since the campaign began. A separate attacker used StyleSmuggler access to install a PHP web shell under the product image cache. The implant connects to its command-and-control server on ports 80, 443, and 8443, disguising traffic as routine HTTPS connections.
The four things you need to do
Apply the hotfix to every instance, including staging
Download VULN-39341-composer-patches.zip from repo.magento.com and apply it as a Composer patch. Confirm correct installation:
vendor/bin/magento-patches -n status | grep "39341\|Status"
Critically, as CrowdSec documents, apply the hotfix to every Adobe Commerce, B2B, and Magento Open Source instance that faces the internet, including staging environments. Staging stores running outdated versions are being actively targeted and provide a path into production environments.
Scan for compromise indicators
Do not assume you were not compromised during the 72-hour exposure window. Run active checks:
Check the media directory for PHP files:
find /pub/media -name '*.php' -type f
Check for recently modified PHP files:
find . -name '*.php' -newer var/log/system.log -type f
Look for unexpected outbound connections on port 123 (NTP masquerade):
netstat -anp | grep :123
Query the email template table:
sql
SELECT template_id, template_code, template_styles
FROM email_template
WHERE template_styles LIKE '%eval%'
OR template_styles LIKE '%base64%'
Fastly's technical analysis explains that StyleSmuggler is a Server-Side Template Injection (SSTI) vulnerability executing across four requests: poisoning logs, injecting a payload into cart address details, triggering execution via a failed payment email, and installing the persistent implant. The presence of unexpected "Payment Transaction Failed Reminder" emails in your mail logs is a specific indicator of exploitation.
Sansec's eComscan tool provides StyleSmuggler-specific detection. CrowdSec has also released a detection scenario for CVE-2026-75650.
Rotate every credential, in the right order
Adobe's rotation checklist is specific. Start with the Commerce encryption key, because it protects everything else. Then rotate:
-
All administrator passwords
-
REST, SOAP, and GraphQL integration tokens
-
OAuth client secrets
-
Payment gateway API credentials (Stripe, PayPal, Adyen, and any others)
-
Database credentials
-
SSH and deploy keys
-
Any third-party extension API keys
As Tenable emphasises, rotating the encryption key alone does not undo anything an attacker already read. Every credential that was accessible during the compromise window must be rotated, because you have no way of knowing which ones were exfiltrated.
Review your September security release status separately
Adobe's September 2026 Commerce security release (APSB26-138) is a separate update from the StyleSmuggler hotfix. Apply both. The September release addresses additional vulnerabilities that the hotfix does not cover, and the hotfix addresses StyleSmuggler specifically in ways the September release does not include.
The broader context
CrowdSec's analysis notes that 23 of the 410 IP addresses hitting StyleSmuggler were also observed attempting the WP2Shell WordPress exploit and the previous Magento SessionReaper vulnerability. The attackers targeting StyleSmuggler are systematically scanning for eCommerce and CMS vulnerabilities across multiple platforms simultaneously.
This is not an opportunistic attack by a single actor. It is an organised campaign, and it is ongoing.
StyleSmuggler is now the second critical eCommerce zero-day Sansec has discovered and publicly disclosed this year, after SessionReaper in autumn 2025. Each incident should be treated as a signal about the ongoing investment attackers are making in eCommerce platform research.
For merchants approaching peak season with an unpatched or unscanned Magento store, the risk is not hypothetical. It is active and has been confirmed across dozens of stores. Apply the patch. Scan for compromise. Rotate credentials. And review your security monitoring posture before Q4 traffic arrives.
About On Tap
On Tap is a growth-focused eCommerce consultancy and Adobe Commerce partner helping mid-market and enterprise merchants maintain secure, patched, and monitored stores through peak season and beyond. From emergency hotfix deployment and compromise scanning to credential rotation and ongoing security monitoring, On Tap helps merchants ensure that security discipline matches the current threat environment.
If you have applied the StyleSmuggler patch and want help verifying whether your store was compromised, get in touch today.
