If you run a store on Adobe Commerce or Magento Open Source, stop and check it before you read the rest of this. A maximum-severity vulnerability nicknamed StyleSmuggler (CVE-2026-75650, CVSS 10.0) has been under active exploitation since 4 September 2026 — three days before Adobe shipped a fix. It was added to CISA's Known Exploited Vulnerabilities catalogue on 8 September, which is the US government's way of saying every organisation running the affected software should treat this as urgent, not routine.
Every version from 2.4.4 up to and including 2.4.9 is affected. Sansec, the security firm that found and named the attack, confirmed successful exploitation against clean installs of 2.4.7, 2.4.8 and 2.4.9 — this is not a theoretical flaw in old, unmaintained versions.
How it works
The vulnerability lets an unauthenticated attacker execute arbitrary code on your server. It abuses Magento's email template engine: the attacker injects PHP through a store's styles configuration, then triggers execution by causing a "Payment Transaction Failed Reminder" email to render, which processes the poisoned template. No login, no admin access, no user interaction required.
Once in, attackers observed by Sansec have deployed a Rust-based Linux backdoor and PHP web shells, and have adapted their delivery method when an initial attempt was blocked — this is an active, evolving campaign, not a single script running once.
What to do today
Patch first. Adobe released Hotfix VULN-39341 on 7 September. If you have not applied it, this is the highest-priority item on your list regardless of anything else on it.
Check for existing compromise, not just the hole. Because active exploitation started before the fix existed, patching now does not undo anything that already happened. Sansec's guidance is to hunt for processes disguised as system daemons — names like [kworker/u:8:0], fc-cache or chronyd that do not belong — and for unexpected PHP files under /pub/media/. A burst of "Payment Transaction Failed Reminder" emails in your logs around early September is itself a signal worth investigating.
Rotate credentials if you find anything, or if you are unsure. Encryption keys, admin passwords, API tokens and database credentials. A backdoor that predates your patch may have already read what it needed.
Do not assume a session-storage change protects you. Sansec was explicit that moving sessions to Redis or the database does not stop this attack — the vulnerability is in template rendering, not session handling, and that specific mitigation people reach for first does not apply here.
If you are not on Adobe Commerce yourself
Two things are still worth ten minutes. First, if you build on top of Magento for clients — as an agency, a freelancer or a plugin vendor — this is a support-ticket wave arriving whether or not you caused it, and getting ahead of it with affected clients today is cheaper than the incident calls next week. Second, the general pattern is the one to remember: a maximum-CVSS flaw in a template engine, reachable without authentication, exploited before a patch existed. That combination is what CISA's list exists to flag, and treating anything on it as "get to it this sprint" rather than "today" is how the three-day gap between exploitation and patch turns into a much longer gap between compromise and discovery.
The bottom line
A CVSS 10.0, unauthenticated, actively-exploited flaw in Adobe Commerce and Magento Open Source has had a fix available since 7 September, and CISA flagged it as under real attack on 8 September. If you run any affected version, apply Hotfix VULN-39341 now, then check your logs and processes for the specific indicators above before you consider yourself safe — patching closes the door, it does not tell you whether someone already walked through it.