CVE-2026-75650 — Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

1. Executive summary

CVE-2026-75650 is a CVSS 10.0 CRITICAL unauthenticated remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, caused by improper neutralization of special elements used in a template engine (CWE-1336). It is listed in CISA KEV (added 2026-09-08) with active in-the-wild exploitation beginning 2026-09-04, codenamed "StyleSmuggler" by Sansec. Exploitation is unauthenticated, requires no session or credentials, and observed intrusions deploy a persistent Linux implant masquerading as a kernel worker thread. Any EMEA financial services client operating an internet-facing Adobe Commerce or Magento storefront — including payment, checkout and transactional-email functions — should treat this as an emergency patch-and-hunt item. Note one discrepancy: the Tenable source reports the CVE as not yet in KEV as of 2026-09-08; the verified NVD/KEV record confirms it was added 2026-09-08, and that value is authoritative here.

2. Regulatory framing

No NIS2 or UK NIS article is cited here: the supplied regulatory reference does not include an article whose scope is specifically triggered by facts distinctive to this item beyond the generic incident/patching triggers, which do not meet the test.

3. Technical analysis & attack chain

Confirmed attack chain (per Sansec research relayed by Tenable; single-sourced for the intrusion detail — see caveat)

1. Initial access. The attacker sends a crafted payload containing PHP code through the style-related properties within Magento's template system. This injection path is not behind any authentication gate — no credentials or session are required.
2. Payload persistence to disk. Magento writes the attacker-controlled content to disk as part of its normal operations.
3. Execution trigger. The injected PHP code executes when the platform renders a transactional email template — specifically the "Payment Transaction Failed Reminder" notification. The technique works regardless of which session storage backend is configured.
4. Post-exploitation implant. The attacker deploys a persistent implant: a malware binary installed at ~/.local/share/.gvfsd/gvfsd-user.
5. Masquerading. The implant masquerades as a Linux kernel thread using the process name [kworker/u:8:0], and also disguises itself using the process names fc-cache and chronyd (both legitimate system utilities).
6. Persistence. A cron job restarts the implant every five minutes; later variants updated the cron interval to twice an hour. The malware supports both x86-64 and arm64 architectures.

Affected versions (per Tenable)

Exploitation timeline. Sansec observed active exploitation beginning 2026-09-04, three days before a vendor patch became available. Multiple victim stores have been confirmed across different attack campaigns; incident response firm Disrex has first-hand experience with at least two compromised stores. Adobe released security patches on Monday (2026-09-07 per publication timing).

Context. Adobe Commerce/Magento has a repeated KEV history: CVE-2025-54236 ("SessionReaper", account takeover via REST API, KEV 2025-10-24), CVE-2024-34102 ("CosmicSting", XXE-to-RCE, KEV 2024-07-17), and CVE-2022-24086 (arbitrary code execution, KEV 2022-02-15). This is the fourth major exploited flaw in this platform family in five years.

Confidence caveat. The intrusion detail — implant path, process masquerade names, cron persistence, architecture support — is single-sourced (Sansec forensics, relayed via Tenable's FAQ). The Hacker News item corroborates the CVSS 10.0 score, the StyleSmuggler name, the 2026-09-04 exploitation start, and active in-the-wild exploitation, but not the implant specifics. Treat the implant detail as high-value but single-sourced; verify against your own telemetry before enforcement action. No threat actor attribution is present in the source material; no attribution is offered here. The NVD entry lists CWE-1336 (improper neutralization of special elements used in a template engine); the source describes the same flaw as template-engine injection via style properties — consistent classifications of the same flaw. Ransomware campaign use is recorded as "Unknown" in the KEV-derived item; do not characterize this as ransomware.

4. Mitigation & containment

P1 — within 24 hours

• Apply the Adobe vendor patch released 2026-09-07 to all Adobe Commerce (2.4.4–2.4.9), Adobe Commerce B2B (1.3.3–1.5.3) and Magento Open Source (2.4.6–2.4.9) instances. The KEV entry sets a remediation due date of 2026-09-11 — four days from issue.
• For any instance that cannot be patched immediately: the KEV-required action states stakeholders are responsible for evaluating each asset's internet exposure; if mitigations are unavailable for cloud-hosted instances, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product.
• Hunt for compromise on every affected host before and after patching — patching does not remove an existing implant. Check specifically for:
• File presence: ~/.local/share/.gvfsd/gvfsd-user
• Processes named [kworker/u:8:0] running from user context (a genuine kernel worker never runs from a user home directory), or unexpected fc-cache / chronyd processes
• Cron entries with 5-minute intervals, or twice-hourly intervals in later variants, restarting the implant
• Isolate any host with confirmed implant artifacts; the implant is a persistent binary with cron-based restart, so removal requires deleting the binary, the cron entry, and killing the process.

P2 — within 72 hours

• Review transactional email logs and template rendering activity since 2026-09-04 for the "Payment Transaction Failed Reminder" template and for anomalous style-property content in template payloads.
• If compromise is confirmed, engage forensics per CISA's "Forensics Triage Requirements" referenced in the KEV entry, and assess DORA Art. 19 reporting obligations (see §2).
• Confirm patch status with any third-party agency or platform provider operating Adobe Commerce/Magento storefronts on your behalf.

P3 — within 7 days

• Verify patched versions across all environments including staging/UAT that mirror production data.
• Add the StyleSmuggler injection path (unauthenticated style-property handling in the template engine) to resilience testing scope under DORA Art. 24.
• Review internet exposure of all e-commerce assets against BOD 26-04 risk-based patching guidance.

5. Indicators of compromise

filepath  ~/.local/share/.gvfsd/gvfsd-user
processname  [kworker/u:8:0]
processname  fc-cache
processname  chronyd

Note: no file hashes, domains, IPs or URLs are present in the source material; none are listed. The IOC set above is single-sourced (Sansec via Tenable); verify before enforcement.

Behavioural indicators

6. Detection

rule IMPLANT_Stylesmuggler_Gvfsd_User_Masquerade
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero"
        description = "Detects StyleSmuggler post-exploitation implant by its on-disk path and masquerade process names. Source artefacts are single-sourced (Sansec via Tenable); tune for false positives from legitimate fc-cache/chronyd binaries."
    strings:
        $path = ".local/share/.gvfsd/gvfsd-user" ascii
        $proc1 = "[kworker/u:8:0]" ascii
        $proc2 = "fc-cache" ascii
        $proc3 = "chronyd" ascii
    condition:
        $path or 2 of ($proc1, $proc2, $proc3)
}

Caveat: the source provides no file content strings, hashes or embedded values for the implant binary itself; this rule matches on the implant's path and masquerade names as reported. fc-cache and chronyd are legitimate system utilities — the rule's multi-name condition is intended to reduce false positives but will not eliminate them; validate alerts against execution context (user home directory, cron parent).

title: StyleSmuggler implant masquerading as kernel worker or system daemon
id: 7a3f2c1e-8b4d-4e6a-9f2c-1d5e7a9b3c0f
status: experimental
description: Detects the StyleSmuggler implant (CVE-2026-75650 post-exploitation) running under masquerade process names from user context, or its cron-based persistence. Artefacts are single-sourced (Sansec via Tenable).
references:

    - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
author: Adverse Trace
date: 2026-09-08
logsource:
    product: linux
    service: process
detection:
    selection_image:
        Image|endswith:

            - '/.local/share/.gvfsd/gvfsd-user'
    selection_procname:
        ProcessName:

            - '[kworker/u:8:0]'
    selection_masq_user_context:
        Image|endswith:

            - '/fc-cache'
            - '/chronyd'
        User|contains:

            - 'www-data'
            - 'apache'
            - 'nginx'
    condition: selection_image or selection_procname or selection_masq_user_context
falsepositives:

    - Legitimate fc-cache or chronyd executions (validate path and user context)
    - Genuine kernel worker threads (these are kernel threads, not user-space processes, and should not appear in process creation logs with an Image path)
level: high

Note: the source does not state which user context the implant runs under; the www-data/apache/nginx filter in selection_masq_user_context is an analyst inference for web-server compromise context, not a source artefact — remove or adjust it to your environment.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD — CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-75650 — 2026-09-07
• Tenable Research — StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day — https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero — 2026-09-08
• The Hacker News — Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html — 2026-09-07

8. Adverse Trace position

This is a maximum-severity (CVSS 10.0, CRITICAL, CWE-1336), KEV-listed, actively exploited unauthenticated RCE in a payment-adjacent platform with a four-day remediation window (due 2026-09-11) — clients running affected Adobe Commerce, Adobe Commerce B2B or Magento Open Source versions should treat patching as an emergency and assume attempted exploitation on any internet-facing instance since 2026-09-04. The verified reference data confirms KEV addition on 2026-09-08 notwithstanding the Tenable FAQ's statement that it was not yet listed as of that date; the verified value governs. The intrusion detail (implant path, masquerade names, cron persistence) is single-sourced to Sansec via Tenable and should be verified against client telemetry before enforcement; no threat actor attribution is available in the source material and none is asserted. Ransomware use is recorded as Unknown — this is not currently a ransomware item. We will monitor for the full Sansec technical report, additional victim confirmation beyond Disrex's two stores, any CISA Emergency Directive or Alert, and multi-source IOC enrichment; updates will follow as a version 1.1 if the picture changes materially.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.