CVE-2026-75650, StyleSmuggler, is a critical zero-day remote code execution vulnerability in Adobe Commerce actively exploited since September 4. Patches now available.

CVE-2026-75650: StyleSmuggler Adobe Commerce FAQ | Tenable®

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

StyleSmuggler is a vulnerability in Magento and Adobe Commerce under active exploitation. Patches are available and customer should review IOCs for potential compromise.

The version of Adobe Commerce/Magento Open Source installed on the remote host is affected by a vulnerability as referenced in the APSB26-146 advisory.

  - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine     vulnerability that could result in arbitrary code execution in the context of the current user. An attacker     could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user     interaction. Scope is changed. (CVE-2026-75650)

Adobe resolved this issue with the VULN-39341 hotfix rather than with a new release, so applying the fix does not change the version that Adobe Commerce / Magento Open Source reports. This plugin only reports a host when the fix is absent from the installation, so an affected version that already carries the hotfix is not flagged.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number and on the presence of the vendor hotfix in the installation.

The version of the Adobe Commerce B2B module installed on the remote host is affected by a vulnerability as referenced in the APSB26-146 advisory.

  - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine     vulnerability that could result in arbitrary code execution in the context of the current user. An attacker     could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user     interaction. Scope is changed. (CVE-2026-75650)

Adobe resolved this issue with the VULN-39341 hotfix, which patches the underlying Adobe Commerce core rather than the B2B module and does not change any reported version. Because the hotfix state cannot be confirmed from the B2B module version alone, this plugin reports the module as potentially affected. The authoritative fix status for the host is reported by the Adobe Commerce / Magento Open Source check.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Magento Open Source / Adobe Commerce is affected by an unauthenticated remote code execution vulnerability known as StyleSmuggler. A remote attacker is able to write PHP code in the application log file through the unescaped store code reported by the GraphQL endpoint, then store a set of nested email directives in the billing address of a guest cart. The global string substitutions performed when the address is rendered wrap the attacker directive with a valid deferred signature, which smuggles an administration preview block into the failed payment email template. That block replays the 'type', 'text' and 'styles' parameters of the current HTTP request, allowing the attacker to instantiate an arbitrary class before its type is validated and to reach a dependency injection scanner which includes the poisoned log file. The whole chain is triggered by a public GraphQL mutation and requires no account, no cart item and no payment method, allowing an attacker to execute arbitrary code in the context of the web server process.

Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.

ID	Name	Product	Family	Type	Severity
344801	Adobe Commerce/Magento Open Source Arbitrary Code Execution (APSB26-146)	Nessus	Misc.	Local	critical
344800	Adobe Commerce B2B Arbitrary Code Execution (APSB26-146)	Nessus	Misc.	Local	critical
115470	Magento Remote Code Execution (StyleSmuggler)	Web App Scanning	Component Vulnerability	Check Based	critical

Detections

Analytics

CVE-2026-75650

critical

Tenable Plugins

critical

critical

critical