Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

1. Executive summary

Adobe has released patches for more than 170 vulnerabilities across its product line, headlined by CVE-2026-75650 (CVSS 10.0, CRITICAL, CWE-1336) — a code injection flaw in Adobe Commerce and Magento Open Source that Adobe confirms is actively exploited in the wild and which was added to CISA KEV on 2026-09-08. Exploitation, codenamed StyleSmuggler by Sansec, began on 2026-04 September 2026 as a zero-day, before patch availability, and allows unauthenticated remote code execution without user interaction. Multiple threat actors are using the flaw to deploy backdoors and PHP web shells against online stores. EMEA financial services clients running Adobe Commerce/Magento storefronts, Adobe Campaign Classic, ColdFusion, or Experience Manager are directly exposed; the Commerce zero-day is the priority and requires patching plus full credential and encryption-key rotation.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by the facts in this item beyond generic patching duties.

3. Technical analysis & attack chain

Vulnerability mechanism. CVE-2026-75650 is a code injection flaw (CWE-1336 per NVD) in Adobe Commerce and Magento Open Source, exploitable without authentication and without user interaction, yielding remote code execution. Sansec's reporting describes the injection vector as code planted such that it executes when Magento's standard Payment Transaction Failed Reminder is triggered — meaning the malicious code runs as part of a legitimate, scheduled store workflow rather than requiring a victim to open anything. Note: the GitHub advisory (GHSA-5g6h-388x-r7r7) describes an "Incorrect Authorization" / security-feature-bypass flaw in Adobe Commerce; this may describe the same underlying authorization weakness as the RCE, but the verified NVD classification for CVE-2026-75650 is CWE-1336 (improper neutralization of special elements used in a template engine).

Confirmed attack chain (multi-source corroborated: SecurityWeek, The Hacker News, ANSSI/CERT-FR, Adobe advisory)

1. Initial access — unauthenticated attacker sends crafted input to an exposed Adobe Commerce / Magento Open Source storefront exploiting CVE-2026-75650 (zero-day from 2026-09-04; patches released 2026-09-07/08).
2. Code execution — injected code is executed server-side when the Magento Payment Transaction Failed Reminder fires; no user interaction required.
3. Post-exploitation — several distinct threat actors are using the flaw to deploy backdoors and PHP web shells (The Hacker News headline references a "Rust backdoor and PHP web shell"; the primary SecurityWeek item confirms backdoors and web shells generally). Specific web shell filenames, paths, and the Rust backdoor's capabilities are not detailed in the available source material.
4. Credential exposure — Sansec assesses that attackers can read data protected by Magento's encryption key, and warns that rotating the encryption key alone does not invalidate anything an attacker has already read.

Attribution: No named threat actor with a MITRE ATT&CK profile is identified in the source material; Sansec refers only to "several threat actors." Attribution is unconfirmed and we make none.

Other notable items in this patch cycle (per Adobe advisory via SecurityWeek)

• CVE-2026-82004 — CVSS 10.0, OS command injection in Adobe Campaign Classic, arbitrary code execution. Priority 1. Not known exploited.
• CVE-2026-48273 — CVSS 9.9, critical code execution in ColdFusion. Priority 1. Not known exploited.
• CVE-2026-75746 — CVSS 9.1, critical code execution in ColdFusion. Priority 1. Not known exploited.
• Eight additional Commerce vulnerabilities patched Tuesday: two critical-severity privilege escalation flaws and six high-severity security bypass / privilege escalation bugs.
• Volume patches: 107 vulnerabilities in Experience Manager, 32 in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, 1 in Animate, plus Photoshop Mobile.

Adobe states none of the newly resolved vulnerabilities other than the Commerce/Magento zero-day are known to be exploited. Only CVE-2026-75650 appears in the verified CISA KEV data (added 2026-09-08); its EPSS score is 1%, which is low relative to its KEV status — treat KEV listing and confirmed in-the-wild exploitation as the operative signal, not EPSS.

Confidence caveat: The StyleSmuggler name, the September 4 exploitation start date, the Payment Transaction Failed Reminder execution mechanism, and the credential-rotation guidance all derive from Sansec's reporting as relayed by SecurityWeek and The Hacker News — single-sourced; verify against Sansec's original report before enforcement action. The exploitation status of CVE-2026-75650 itself is independently corroborated by Adobe's advisory and ANSSI/CERT-FR (CERTFR-2026-AVI-1130).

4. Mitigation & containment

P1 — within 24 hours

1. Patch Adobe Commerce / Magento Open Source immediately for CVE-2026-75650. This is a CISA KEV entry under active exploitation; do not wait for a maintenance window. Apply Adobe's hotfix and the full APSB update; consult Adobe's KB article for the specific update details.
2. Rotate the Magento encryption key and every credential it protects — at the source, not only inside Magento. Per Sansec: administrative passwords, database credentials, integration tokens, OAuth secrets, SSH and deploy keys, and API keys. Rotating the encryption key alone does not invalidate anything an attacker already read.
3. Hunt for web shells and backdoors before declaring clean. On any Commerce/Magento host: audit recently modified .php files under the Magento webroot and pub/, review scheduled jobs and cron entries for the Payment Transaction Failed Reminder workflow, and review admin-user creation and integration-token changes since 2026-09-04. Assume compromise on unpatched, internet-facing stores.
4. Apply the Campaign Classic fix for CVE-2026-82004 (CVSS 10.0 OS command injection). Campaign instances frequently hold large customer datasets and are often less monitored than storefronts.

P2 — within 72 hours (Adobe's priority-1 SLA is three days)

5. Patch ColdFusion for CVE-2026-48273 (9.9) and CVE-2026-75746 (9.1) plus the seven high/medium issues. If patching is delayed, restrict ColdFusion admin and component endpoints at the WAF/reverse proxy to administrative networks.
6. Apply the eight additional Commerce patches (two critical privilege escalation, six high security bypass / privilege escalation).
7. Inventory exposure: confirm which business units run Commerce/Magento, Campaign Classic, ColdFusion, and Experience Manager. Experience Manager's 107 CVEs make it the largest volume item; schedule within the normal cycle unless a critical surfaces in your version range.

P3 — within 7 days

8. Patch Experience Manager, Acrobat Reader, Photoshop, Illustrator, Animate, and Photoshop Mobile per standard desktop/server patch cycles; Reader deployments can ride the standard SDLC.
9. For storefronts that were unpatched between 2026-09-04 and patch date, conduct a full credential and payment-data review and consider whether the event triggers DORA Art. 19 reporting obligations (see §2).

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe deployment of backdoors and PHP web shells via CVE-2026-75650 but provide no hashes, filenames, domains, or IPs. The Rust backdoor referenced in The Hacker News headline is not further described.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material names the vulnerability, the execution trigger (Payment Transaction Failed Reminder), and generic payload classes (PHP web shell, Rust backdoor) but contains no strings, filenames, paths, registry keys, mutexes, or command lines attributable to the threat artefacts themselves. A rule keyed on "StyleSmuggler" or "CVE-2026-75650" would detect reporting about the threat, not the threat. Revisit once Sansec's full report with technical indicators is obtained.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• SecurityWeek — Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day — https://www.securityweek.com/adobe-patches-over-170-vulnerabilities-including-commerce-zero-day/ — 2026-09-08
• The Hacker News — Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html — 2026-09
• SecurityWeek — Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/ — 2026-09
• ANSSI France CERT (CERT-FR) — Vulnérabilité dans les produits Adobe (CERTFR-2026-AVI-1130) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1130/ — 2026-09-08
• GitHub Security Advisory GHSA-5g6h-388x-r7r7 — Adobe Commerce Incorrect Authorization vulnerability — https://github.com/advisories/GHSA-5g6h-388x-r7r7 — 2026
• SecurityWeek — Adobe Commerce Bug Targeted Immediately After Disclosure — https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/ — 2026 (context; references CVE-2026-71362, a separate Commerce flaw)

8. Adverse Trace position

CVE-2026-75650 is the highest-priority item in this cycle: CVSS 10.0 CRITICAL, CISA KEV-listed as of 2026-09-08, actively exploited in the wild since 2026-09-04 as an unauthenticated, no-user-interaction RCE in payment-facing storefront software — a direct fraud and card-data risk for any financial services client operating an Adobe Commerce or Magento storefront, and a supply-chain exposure for those whose merchants or partners do. The patch is available and there is no reason to delay; the equally critical and routinely skipped step is full source-side rotation of the encryption key and every credential it protects, since Sansec's guidance is explicit that key rotation alone does not undo attacker access to already-read secrets. The Campaign Classic and ColdFusion priority-1 items follow within Adobe's three-day SLA. We assess with high confidence that exploitation is ongoing (Adobe, CISA KEV, ANSSI, and Sansec all corroborate); we assess attribution as unconfirmed — no actor is named in the available material — and note that the StyleSmuggler technical detail is single-sourced to Sansec. Adverse Trace will monitor for Sansec's full technical report and any published IOC sets, update this advisory with detection content when artefacts become available, and track the KEV entry for any added remediation deadlines.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.