Somewhere out there, a Magento store just sent a customer a perfectly routine "your payment failed" email — and also, unbeknownst to everyone, handed a stranger the keys to the server. That's the kind of two-for-one deal nobody asked for, but it's exactly what CVE-2026-75650 has been quietly pulling off since early September.
A Perfect 10, In the Worst Way
Dubbed StyleSmuggler, CVE-2026-75650 is a critical unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source, carrying the maximum possible CVSS score of 10.0. No login, no user interaction, no social engineering required — just a vulnerable store sitting on the internet.
The mechanism is almost elegant in its nastiness: attackers smuggle malicious PHP code through HTTP headers and parameters, where it sits dormant until Magento's template engine renders a "Payment Transaction Failed Reminder" email. That routine, automated email becomes the trigger that executes the attacker's code. Every version from 2.4.4 through 2.4.9 is affected, and Adobe confirmed active exploitation was underway starting September 4 — a full three days before Hotfix VULN-39341 shipped on September 7.
Squatters Are Already Moving In
This wasn't a quiet, theoretical bug. CrowdSec tracked roughly 500 unique IP addresses firing matching exploit requests since September 9. Researchers at Sansec found something even stranger: two unrelated attacker groups operating on the same compromised stores — one planting a persistent backdoor, the other dropping a separate PHP web shell into the product image cache, apparently unaware the other had already broken in.
That's the real lesson buried in the technical details: once a zero-day like this goes public, your store isn't just a target for one attacker. It's a target for whoever gets there first, and then whoever gets there second, third, and so on — each one leaving their own trapdoor behind.
If you're running Magento or Adobe Commerce and haven't applied VULN-39341 yet, that failed-payment email isn't the only thing that needs your attention today.
Patching a zero-day after the fact is damage control — building security review into your ecommerce stack from the start is what actually keeps you off the exploit lists; grab our free developer security checklist to see where the gaps usually hide.
Source: BleepingComputer