CVE-2026-75650 (StyleSmuggler): Adobe Commerce and Magento Unauthenticated RCE — Detection and Emergency Remediation Guide | Security Arsenal

On September 4, 2026, attackers began actively exploiting a critical unauthenticated remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe's emergency hotfix — VULN-39341 — did not ship until September 7, 2026. That means defenders had a three-day window where the only thing standing between an unauthenticated internet attacker and full code execution on their e-commerce platform was... nothing. Multiple victim stores have already been confirmed compromised across different attack campaigns, indicating more than one threat actor obtained and operationalized the exploit.

The vulnerability, tracked as CVE-2026-75650 and dubbed StyleSmuggler, can be triggered remotely without any authentication. For e-commerce platforms, this is the nightmare scenario: the affected systems sit directly on the internet, process payment data, and frequently fall under PCI-DSS scope. An unauthenticated RCE on a Magento store is not just a vulnerability-management problem — it is a potential cardholder data breach, a Magecart-style skimmer deployment opportunity, and a regulatory incident all at once.

If you run Adobe Commerce or Magento Open Source and have not yet applied Hotfix VULN-39341, treat this as an active incident, not a patching ticket. Assume exposure, hunt for compromise, then patch.

Technical Analysis

Affected Products

Adobe Commerce (on-premises and cloud infrastructure deployments)
Adobe Commerce B2B
Magento Open Source

These platforms share the same underlying PHP codebase, which is why a single flaw spans all three product lines. Any internet-facing instance that had not received Hotfix VULN-39341 as of September 7, 2026 must be considered potentially compromised.

Vulnerability Profile

Attribute	Detail
CVE	CVE-2026-75650
Name	StyleSmuggler
Type	Unauthenticated remote code execution
Authentication required	None
Exploitation status	Actively exploited in the wild since 2026-09-04
Vendor fix	Adobe Hotfix VULN-39341, released 2026-09-07
Attack campaigns	Multiple distinct campaigns confirmed

How the Attack Works (Defender's View)

Based on the confirmed exploitation pattern, the attack chain defenders need to model looks like this:

Unauthenticated request to a vulnerable storefront component. The attacker sends a crafted HTTP request — typically a POST to a front-end route handled by the vulnerable code path — smuggling a malicious payload through what appears to be benign style/template input (hence the "StyleSmuggler" moniker).
Server-side code execution under the web server / PHP-FPM process context. The payload executes as the web user (www-data, apache, nginx, or the deployment user on Adobe Commerce Cloud). This is the critical pivot: the PHP-FPM or web server process spawning a shell or interpreter is your highest-fidelity detection signal.
Post-exploitation. Observed behavior in Magento compromises of this class — and consistent with the multiple campaigns reported here — includes webshell drops into web-accessible directories (pub/, pub/media/, var/, generated/), deployment of credit card skimmers injected into checkout JavaScript, creation of rogue admin accounts, and establishment of persistence via cron or modified core files.

Exploitation Status

This is not theoretical. Exploitation began September 4, 2026 — three days before the patch existed — and multiple victim stores have been confirmed across separate campaigns. The three-day head start means mass scanning and indiscriminate exploitation almost certainly began before most defenders even knew the CVE number. Given the exploitation velocity, expect this to land in CISA's Known Exploited Vulnerabilities catalog; treat it with KEV-level urgency regardless of formal listing.

Detection & Response

The highest-fidelity signals for StyleSmuggler exploitation are behavioral, not IOC-based, because payload content varies between campaigns. Focus on three observable behaviors:

The web/PHP process spawning shells, interpreters, or downloaders (the RCE itself).
New executable/PHP files appearing in web-accessible Magento directories (webshell staging).
Egress connections from the web server process (payload retrieval and C2).

SIGMA Rules

YAML

---
title: Magento or PHP-FPM Process Spawning Shell or Interpreter
title_text: StyleSmuggler CVE-2026-75650 exploitation indicator
id: 8c1e4a72-3b6f-4d9a-b2e7-5f0c1d8a9e34
status: experimental
description: Detects the web server or PHP-FPM worker process spawning a shell, interpreter, or downloader — the primary observable of unauthenticated RCE exploitation against Magento/Adobe Commerce (CVE-2026-75650).
references:
  - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some Magento cron or maintenance scripts invoked via web handlers; tune per environment
level: critical
---
title: Webshell Dropped in Magento Web-Accessible Directory
id: 2f7b9d51-6e4a-4c38-a1d0-9b8e3f7c2a65
status: experimental
description: Detects creation of PHP files in Magento web-accessible directories (pub/, pub/media/, pub/static/) — a hallmark of webshell staging following RCE exploitation such as CVE-2026-75650 StyleSmuggler.
references:
  - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/pub/media/'
      - '/pub/static/'
      - '/pub/opt/'
      - '/var/importexport/'
      - '/var/import/'
      - '/downloader/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  filter_deploy:
    Image|contains:
      - '/bin/magento'
      - 'composer'
  condition: selection and not filter_deploy
falsepositives:
  - Legitimate media import modules that write PHP (rare); deployment pipelines uploading theme files
level: high
---
title: Suspicious Outbound Connection from PHP-FPM or Web Server Process
id: 4d3a8c16-1e9b-4f27-b5d3-8a6c2e9f0b47
status: experimental
description: Detects outbound network connections initiated by the web server or PHP-FPM process to uncommon destinations — consistent with payload retrieval or C2 after StyleSmuggler (CVE-2026-75650) exploitation.
references:
  - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1105
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
    Initiated: 'true'
  filter_payment_gateways:
    DestinationHostname|contains:
      - 'paypal.com'
      - 'stripe.com'
      - 'braintreepayments.com'
      - 'adyen.com'
      - 'authorizenet.com'
      - 'amazonaws.com'
      - 'adobe.io'
  condition: selection and not filter_payment_gateways
falsepositives:
  - Legitimate outbound API calls to payment gateways, shipping providers, and CDNs — build an allowlist of known integration endpoints
level: medium

A note on tuning: the PHP-FPM spawning a shell rule should be near-zero noise on a healthy Magento host. If it fires and you cannot tie it to a deployment or maintenance window within minutes, you are looking at a live incident. The egress rule requires an allowlist of your payment/shipping/CDN integrations — invest the 30 minutes to build it, because Magento stores are high-value targets and this rule will pay for itself.

KQL Hunt (Microsoft Sentinel / Defender)

Magento hosts typically report into Sentinel via Syslog/CEF ingestion or the Defender for Endpoint agent on Linux. The following hunts cover the process-spawn and webshell behaviors.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Web server or PHP-FPM spawning shells/interpreters (StyleSmuggler RCE)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where FileName has_any ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Syslog-ingested hosts — webshell writes and suspicious POST bursts to storefront routes
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("magento", "commerce", "web", "shop") // adjust to your host naming
| where SyslogMessage has_any ("pub/media", "pub/static", "var/import")
  and SyslogMessage has_any (".php", ".phtml", ".phar")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Egress from web tier — payload retrieval or C2 after exploitation
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where RemoteIPType == "Public"
| where RemoteUrl !has_any ("paypal.com", "stripe.com", "adyen.com", "amazonaws.com", "adobe.io") // extend allowlist
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl, RemotePort
| order by FirstSeen asc

Run Hunt 3 with a long lookback. First-seen analysis on egress destinations is how you find the low-and-slow C2 that indiscriminate scanning campaigns leave behind.

Velociraptor VQL Hunt

Use this artifact across your Magento/Commerce fleet to simultaneously surface suspicious child processes, recently dropped PHP files in web-accessible directories, and unexpected listening or egress connections from the web user.

VQL — Velociraptor

-- StyleSmuggler (CVE-2026-75650) post-exploitation hunt
-- Suspicious processes, webshell artifacts, and web-tier network connections

-- Section 1: Shells/interpreters spawned by web server or PHP-FPM
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(php-fpm|apache2|httpd|nginx)'
   OR CommandLine =~ '(php-fpm|apache2|httpd|nginx)')
   AND Name =~ '^(sh|bash|dash|python|python3|perl|curl|wget|nc|ncat)$'

-- Section 2: Recently created PHP/webshell files in web-accessible Magento paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/**/pub/media/**/*.php', '/**/pub/static/**/*.php',
                 '/**/pub/opt/**/*.php', '/**/var/import*/**/*.php',
                 '/**/*.phtml'])
WHERE Mtime > '2026-09-01'
ORDER BY Mtime DESC

-- Section 3: Outbound connections held by web-tier processes
SELECT Pid, Name, Status, LocalAddress, LocalPort, RemoteAddress, RemotePort
FROM netstat()
WHERE Name =~ '(php-fpm|apache2|httpd|nginx)'
  AND Status =~ 'ESTABLISHED'
  AND RemoteAddress !~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)'

Note the Mtime pivot date of 2026-09-01 — deliberately a few days before the September 4 first-exploitation date, because webshells are often staged quietly and only exercised later.

Remediation and Verification Script (Bash)

Run this on each Magento/Adobe Commerce host (or bake it into your configuration management). It checks for the hotfix, hunts for common post-exploitation artifacts, and snapshots indicators for your IR team. This script verifies and hunts — it does not replace applying the vendor hotfix.

Bash / Shell

#!/bin/bash
# CVE-2026-75650 (StyleSmuggler) verification + compromise assessment
# Run as root or the Magento deployment user on each affected host
set -euo pipefail
MAGENTO_ROOT="${1:-/var/www/html/magento2}"
REPORT="/tmp/stylesmuggler_check_$(date +%Y%m%d_%H%M%S).txt"

echo "=== StyleSmuggler CVE-2026-75650 Assessment: $(hostname) ===" | tee "$REPORT"

# 1. Check whether Hotfix VULN-39341 is present (patch listed in applied patches log)
echo "--- [1] Hotfix VULN-39341 status ---" | tee -a "$REPORT"
if [ -f "$MAGENTO_ROOT/vendor/magento/framework/composer.json" ] || [ -d "$MAGENTO_ROOT/app/etc" ]; then
  if grep -rqi "VULN-39341" "$MAGENTO_ROOT/app/etc" "$MAGENTO_ROOT/vendor/composer" 2>/dev/null \
     || [ -f "$MAGENTO_ROOT/app/etc/patches_applied.list" ] && grep -qi "VULN-39341" "$MAGENTO_ROOT/app/etc/patches_applied.list" 2>/dev/null; then
    echo "[OK] Hotfix VULN-39341 reference found." | tee -a "$REPORT"
  else
    echo "[ALERT] Hotfix VULN-39341 NOT detected — host is likely UNPATCHED." | tee -a "$REPORT"
  fi
else
  echo "[WARN] Magento root not found at $MAGENTO_ROOT — pass correct path as argument." | tee -a "$REPORT"
fi

# 2. Hunt for recently created PHP files in web-accessible directories (webshell staging)
echo "--- [2] PHP files created/modified since 2026-09-01 in web-accessible paths ---" | tee -a "$REPORT"
find "$MAGENTO_ROOT/pub/media" "$MAGENTO_ROOT/pub/static" "$MAGENTO_ROOT/pub/opt" \
     "$MAGENTO_ROOT/var/importexport" "$MAGENTO_ROOT/var/import" \
     -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \
     -newermt '2026-09-01' -ls 2>/dev/null | tee -a "$REPORT" || true

# 3. Look for PHP-FPM / web server spawning shells in auth/syslog (audit evidence)
echo "--- [3] Evidence of web process spawning shells (audit/syslog) ---" | tee -a "$REPORT"
grep -hEi 'php-fpm|apache2|httpd|nginx' /var/log/syslog /var/log/messages /var/log/audit/audit.log 2>/dev/null \
  | grep -Ei '/bin/(ba)?sh|/usr/bin/(curl|wget|python|perl|nc)' | tail -50 | tee -a "$REPORT" || echo "No direct hits." | tee -a "$REPORT"

# 4. Flag recently modified core/theme files (skimmer injection into checkout JS/templates)
echo "--- [4] Recently modified template/JS files (possible skimmer injection) ---" | tee -a "$REPORT"
find "$MAGENTO_ROOT/app/design" "$MAGENTO_ROOT/app/code" "$MAGENTO_ROOT/vendor" \
     -type f \( -name '*.phtml' -o -name '*.js' -o -name '*.php' \) \
     -newermt '2026-09-04' -ls 2>/dev/null | head -100 | tee -a "$REPORT" || true

# 5. List rogue admin users (check Magento admin_user table timestamps)
echo "--- [5] Admin accounts created since 2026-09-01 ---" | tee -a "$REPORT"
echo "Run manually against the DB:" | tee -a "$REPORT"
echo "  SELECT user_id, username, email, created FROM admin_user WHERE created >= '2026-09-01';" | tee -a "$REPORT"

# 6. Unexpected egress listeners/connections from web user
echo "--- [6] Active connections owned by web processes ---" | tee -a "$REPORT"
ss -tupn 2>/dev/null | grep -Ei 'php-fpm|apache2|httpd|nginx' | tee -a "$REPORT" || true

echo "=== Report saved to $REPORT ===" | tee -a "$REPORT"
echo "If sections 2, 3, or 4 returned hits and the host was unpatched before 2026-09-07: declare an incident."

Remediation

This is an actively exploited unauthenticated RCE. The remediation order matters — patching first without hunting means you may close the door on an attacker who is already inside.

Immediate (today)

Apply Adobe Hotfix VULN-39341 immediately on all Adobe Commerce, Adobe Commerce B2B, and Magento Open Source instances. Adobe released the fix on September 7, 2026 — every day unpatched since then is exposure to a known-exploited vulnerability with public adversary interest. Pull the hotfix and instructions from the official Adobe security advisory at https://helpx.adobe.com/security/security-bulletin.html and the Adobe Commerce/Magento download portal.
Hunt before and after patching. Any instance that was internet-facing and unpatched between September 4 and your patch date must be treated as potentially compromised. Run the Bash verification script above, deploy the Sigma rules to your EDR/log pipeline, and execute the Sentinel and Velociraptor hunts with a lookback to September 1, 2026.
If you cannot patch immediately, place the storefront behind a WAF with virtual patching rules targeting anomalous POST bodies to storefront routes, restrict access to staging/admin paths by IP allowlist, and increase logging on the web tier. These are compensating controls, not fixes.

Compromise Assessment (if the hunt returns hits)

Preserve evidence before cleaning. Snapshot the host, capture the web root, PHP-FPM logs, access logs, and the Magento database (specifically admin_user, core_config_data, and any recently modified CMS blocks — skimmers are frequently injected into the database, not the filesystem).
Rotate everything. Magento admin credentials, database credentials, API keys, payment gateway tokens, and any secrets in app/etc/env.php. Assume the web user's readable secrets are gone.
Audit for rogue admin accounts (SELECT user_id, username, email, created FROM admin_user WHERE created >= '2026-09-01';) and unexpected cron entries (crontab -l -u www-data and the Magento cron_schedule table).
Check for payment skimmers. Diff checkout-related JS and templates against a known-good build. If cardholder data may have been exposed, engage your PCI-DSS obligations and legal counsel now, not later.

Follow-Up

Rebuild from known-good for any host with confirmed post-exploitation artifacts. In-place cleaning of a PHP application after unauthenticated RCE is high-risk; a clean redeploy from your CI/CD pipeline with rotated credentials is the defensible answer.
Operationalize the detections. Move the Sigma rules above from experimental to production with environment-appropriate allowlists, and add the first-seen egress hunt (KQL Hunt 3) as a recurring scheduled query in Sentinel.
Close the patch-gap window structurally. Three days of zero-day exposure is survivable if your mean-time-to-patch for critical e-commerce platform fixes is measured in hours. If it is measured in weeks, that — not StyleSmuggler — is your real finding.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-75650 (StyleSmuggler): Adobe Commerce and Magento Unauthenticated RCE — Detection and Emergency Remediation Guide