> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-75650 — Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-75650-adobe-commerce-and-magento-adobe-commerce-and-magento-improper-neutralization-of-special-elements-used-in-a-template-engine-vulnerability/ - Published: 2026-09-08T20:24:53.000Z - Updated: 2026-09-08T20:24:53.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-75650 ## 1\. Executive summary CVE-2026-75650 is a CVSS 10.0 CRITICAL unauthenticated remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, caused by improper neutralization of special elements used in a template engine (CWE-1336). It is listed in CISA KEV (added 2026-09-08) with active in-the-wild exploitation beginning 2026-09-04, codenamed "StyleSmuggler" by Sansec. Exploitation is unauthenticated, requires no session or credentials, and observed intrusions deploy a persistent Linux implant masquerading as a kernel worker thread. Any EMEA financial services client operating an internet-facing Adobe Commerce or Magento storefront — including payment, checkout and transactional-email functions — should treat this as an emergency patch-and-hunt item. Note one discrepancy: the Tenable source reports the CVE as not yet in KEV as of 2026-09-08; the verified NVD/KEV record confirms it was added 2026-09-08, and that value is authoritative here. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Confirmed zero-day exploitation of a CVSS 10.0 flaw on payment-facing storefronts since 2026-09-04, with confirmed compromised merchant stores (per Sansec/Disrex) and a KEV entry — a plausible major-incident trigger for any client running affected versions | Clients with confirmed or suspected compromise must assess classification and prepare Art. 19 reporting rather than treating this as routine patching | | DORA Art. 24: digital operational resilience testing — general requirements | The flaw is unauthenticated, pre-authentication, and independent of session storage backend — meaning standard perimeter/WAF assumptions did not hold; the injection path sits in the transactional-email rendering pipeline | Post-patch, clients should verify compensating controls and include this attack path in resilience testing of e-commerce ICT assets | | DORA Art. 28: ICT third-party risk — general principles | Affected deployments include Adobe Commerce (a commercial Adobe product) and Adobe Commerce B2B, commonly operated by or contracted through e-commerce platform providers | Clients running storefronts via third-party providers must confirm the provider's patch status and incident-response posture under existing ICT third-party risk processes | No NIS2 or UK NIS article is cited here: the supplied regulatory reference does not include an article whose scope is specifically triggered by facts distinctive to this item beyond the generic incident/patching triggers, which do not meet the test. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (per Sansec research relayed by Tenable; single-sourced for the intrusion detail — see caveat) 1. **Initial access.** The attacker sends a crafted payload containing PHP code through the style-related properties within Magento's template system. This injection path is not behind any authentication gate — no credentials or session are required. 2. **Payload persistence to disk.** Magento writes the attacker-controlled content to disk as part of its normal operations. 3. **Execution trigger.** The injected PHP code executes when the platform renders a transactional email template — specifically the "Payment Transaction Failed Reminder" notification. The technique works regardless of which session storage backend is configured. 4. **Post-exploitation implant.** The attacker deploys a persistent implant: a malware binary installed at `~/.local/share/.gvfsd/gvfsd-user`. 5. **Masquerading.** The implant masquerades as a Linux kernel thread using the process name `[kworker/u:8:0]`, and also disguises itself using the process names `fc-cache` and `chronyd` (both legitimate system utilities). 6. **Persistence.** A cron job restarts the implant every five minutes; later variants updated the cron interval to twice an hour. The malware supports both x86-64 and arm64 architectures. ### Affected versions (per Tenable) | Product | Affected versions | | ------------------- | ------------------- | | Adobe Commerce | 2.4.4 through 2.4.9 | | Adobe Commerce B2B | 1.3.3 through 1.5.3 | | Magento Open Source | 2.4.6 through 2.4.9 | **Exploitation timeline.** Sansec observed active exploitation beginning 2026-09-04, three days before a vendor patch became available. Multiple victim stores have been confirmed across different attack campaigns; incident response firm Disrex has first-hand experience with at least two compromised stores. Adobe released security patches on Monday (2026-09-07 per publication timing). **Context.** Adobe Commerce/Magento has a repeated KEV history: CVE-2025-54236 ("SessionReaper", account takeover via REST API, KEV 2025-10-24), CVE-2024-34102 ("CosmicSting", XXE-to-RCE, KEV 2024-07-17), and CVE-2022-24086 (arbitrary code execution, KEV 2022-02-15). This is the fourth major exploited flaw in this platform family in five years. **Confidence caveat.** The intrusion detail — implant path, process masquerade names, cron persistence, architecture support — is single-sourced (Sansec forensics, relayed via Tenable's FAQ). The Hacker News item corroborates the CVSS 10.0 score, the StyleSmuggler name, the 2026-09-04 exploitation start, and active in-the-wild exploitation, but not the implant specifics. Treat the implant detail as high-value but single-sourced; verify against your own telemetry before enforcement action. No threat actor attribution is present in the source material; no attribution is offered here. The NVD entry lists CWE-1336 (improper neutralization of special elements used in a template engine); the source describes the same flaw as template-engine injection via style properties — consistent classifications of the same flaw. Ransomware campaign use is recorded as "Unknown" in the KEV-derived item; do not characterize this as ransomware. ## 4\. Mitigation & containment ### P1 — within 24 hours - Apply the Adobe vendor patch released 2026-09-07 to all Adobe Commerce (2.4.4–2.4.9), Adobe Commerce B2B (1.3.3–1.5.3) and Magento Open Source (2.4.6–2.4.9) instances. The KEV entry sets a remediation due date of 2026-09-11 — four days from issue. - For any instance that cannot be patched immediately: the KEV-required action states stakeholders are responsible for evaluating each asset's internet exposure; if mitigations are unavailable for cloud-hosted instances, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product. - Hunt for compromise on every affected host before and after patching — patching does not remove an existing implant. Check specifically for: - File presence: `~/.local/share/.gvfsd/gvfsd-user` - Processes named `[kworker/u:8:0]` running from user context (a genuine kernel worker never runs from a user home directory), or unexpected `fc-cache` / `chronyd` processes - Cron entries with 5-minute intervals, or twice-hourly intervals in later variants, restarting the implant - Isolate any host with confirmed implant artifacts; the implant is a persistent binary with cron-based restart, so removal requires deleting the binary, the cron entry, and killing the process. ### P2 — within 72 hours - Review transactional email logs and template rendering activity since 2026-09-04 for the "Payment Transaction Failed Reminder" template and for anomalous style-property content in template payloads. - If compromise is confirmed, engage forensics per CISA's "Forensics Triage Requirements" referenced in the KEV entry, and assess DORA Art. 19 reporting obligations (see §2). - Confirm patch status with any third-party agency or platform provider operating Adobe Commerce/Magento storefronts on your behalf. ### P3 — within 7 days - Verify patched versions across all environments including staging/UAT that mirror production data. - Add the StyleSmuggler injection path (unauthenticated style-property handling in the template engine) to resilience testing scope under DORA Art. 24. - Review internet exposure of all e-commerce assets against BOD 26-04 risk-based patching guidance. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------ | -------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------ | | file path | \~/.local/share/.gvfsd/gvfsd-user | High (single-sourced) | Sansec via Tenable | | process name | \[kworker/u:8:0\] | High (single-sourced) | Sansec via Tenable | | process name | fc-cache | Medium (masquerade name; legitimate binary also uses it) | Sansec via Tenable | | process name | chronyd | Medium (masquerade name; legitimate binary also uses it) | Sansec via Tenable | | behaviour | Cron job restarting implant every 5 minutes (later variants: twice hourly) | High (single-sourced) | Sansec via Tenable | ```iocs filepath ~/.local/share/.gvfsd/gvfsd-user processname [kworker/u:8:0] processname fc-cache processname chronyd ``` Note: no file hashes, domains, IPs or URLs are present in the source material; none are listed. The IOC set above is single-sourced (Sansec via Tenable); verify before enforcement. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | --------------------- | | Unauthenticated requests carrying PHP code in style-related template properties | Web server / WAF / CDN access logs for Adobe Commerce endpoints, since 2026-09-04 | High (single-sourced) | | Rendering of "Payment Transaction Failed Reminder" transactional email template correlated with unexpected process execution | Email template render logs; process creation events on the web host | High (single-sourced) | | User-context process named \[kworker/u:8:0\] | EDR / process telemetry — genuine kworkers are kernel threads and never appear as user-space binaries | High (single-sourced) | | Cron entries at 5-minute or twice-hourly intervals invoking \~/.local/share/.gvfsd/gvfsd-user | Cron logs, EDR scheduled-task/process monitoring | High (single-sourced) | ## 6\. Detection ```yara rule IMPLANT_Stylesmuggler_Gvfsd_User_Masquerade { meta: author = "Adverse Trace" date = "2026-09-08" reference = "https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero" description = "Detects StyleSmuggler post-exploitation implant by its on-disk path and masquerade process names. Source artefacts are single-sourced (Sansec via Tenable); tune for false positives from legitimate fc-cache/chronyd binaries." strings: $path = ".local/share/.gvfsd/gvfsd-user" ascii $proc1 = "[kworker/u:8:0]" ascii $proc2 = "fc-cache" ascii $proc3 = "chronyd" ascii condition: $path or 2 of ($proc1, $proc2, $proc3) } ``` Caveat: the source provides no file content strings, hashes or embedded values for the implant binary itself; this rule matches on the implant's path and masquerade names as reported. `fc-cache` and `chronyd` are legitimate system utilities — the rule's multi-name condition is intended to reduce false positives but will not eliminate them; validate alerts against execution context (user home directory, cron parent). ```yaml title: StyleSmuggler implant masquerading as kernel worker or system daemon id: 7a3f2c1e-8b4d-4e6a-9f2c-1d5e7a9b3c0f status: experimental description: Detects the StyleSmuggler implant (CVE-2026-75650 post-exploitation) running under masquerade process names from user context, or its cron-based persistence. Artefacts are single-sourced (Sansec via Tenable). references: - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero author: Adverse Trace date: 2026-09-08 logsource: product: linux service: process detection: selection_image: Image|endswith: - '/.local/share/.gvfsd/gvfsd-user' selection_procname: ProcessName: - '[kworker/u:8:0]' selection_masq_user_context: Image|endswith: - '/fc-cache' - '/chronyd' User|contains: - 'www-data' - 'apache' - 'nginx' condition: selection_image or selection_procname or selection_masq_user_context falsepositives: - Legitimate fc-cache or chronyd executions (validate path and user context) - Genuine kernel worker threads (these are kernel threads, not user-space processes, and should not appear in process creation logs with an Image path) level: high ``` Note: the source does not state which user context the implant runs under; the `www-data`/`apache`/`nginx` filter in `selection_masq_user_context` is an analyst inference for web-server compromise context, not a source artefact — remove or adjust it to your environment. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-75650](https://nvd.nist.gov/vuln/detail/CVE-2026-75650?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-09-08 | 1% | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could… | ## 7\. Sources - NVD — CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-75650 — 2026-09-07 - Tenable Research — StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day — https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero — 2026-09-08 - The Hacker News — Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html — 2026-09-07 ## 8\. Adverse Trace position This is a maximum-severity (CVSS 10.0, CRITICAL, CWE-1336), KEV-listed, actively exploited unauthenticated RCE in a payment-adjacent platform with a four-day remediation window (due 2026-09-11) — clients running affected Adobe Commerce, Adobe Commerce B2B or Magento Open Source versions should treat patching as an emergency and assume attempted exploitation on any internet-facing instance since 2026-09-04\. The verified reference data confirms KEV addition on 2026-09-08 notwithstanding the Tenable FAQ's statement that it was not yet listed as of that date; the verified value governs. The intrusion detail (implant path, masquerade names, cron persistence) is single-sourced to Sansec via Tenable and should be verified against client telemetry before enforcement; no threat actor attribution is available in the source material and none is asserted. Ransomware use is recorded as Unknown — this is not currently a ransomware item. We will monitor for the full Sansec technical report, additional victim confirmation beyond Disrex's two stores, any CISA Emergency Directive or Alert, and multi-source IOC enrichment; updates will follow as a version 1.1 if the picture changes materially. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-75650?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*