CVE-2026-75650

critical

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

From the Tenable Blog

CVE-2026-75650: StyleSmuggler Adobe Commerce FAQ | Tenable®

Published: 2026-09-08

CVE-2026-75650, StyleSmuggler, is a critical zero-day remote code execution vulnerability in Adobe Commerce actively exploited since September 4. Patches now available.

References

https://helpx.adobe.com/security/products/magento/apsb26-146.html

https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/

https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

https://sansec.io/research/stylesmuggler-0day

https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero

https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos

https://github.com/disrex-group/stylesmuggler-adobe-patches

https://github.com/dinosn/cve-2026-75650-magento-validation-lab

Details

Source: Mitre, NVD

Published: 2026-09-07

Updated: 2026-09-08

Named Vulnerability: StyleSmuggler

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H