Magento CVE-2026-75650: Payment Failure Emails Used for RCE

Exploitation Emerges: The StyleSmuggler Campaign

CVE-2026-75650, a severe remote code execution (RCE) vulnerability affecting Adobe Commerce and Magento Open Source, has been actively exploited. Security firm Sansec identified exploitation starting September 4, 2026, under the campaign name StyleSmuggler. This prompted CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog on September 8, 2026. Adobe responded with an emergency hotfix, VULN-39341, released on September 7, 2026, under advisory APSB26-146. The critical window for exposure was the three days between the start of exploitation and the hotfix release. Importantly, stores compromised before the hotfix was applied were not automatically secured by its installation; remediation required additional steps.

Deep Dive: The Template Rendering Flaw

The vulnerability, classified under CWE-1336, stems from improper neutralization of special elements within Magento's template engine. Affected versions include Adobe Commerce 2.4.4 through 2.4.9, as well as Adobe Commerce B2B versions 1.3.3 through 1.3.9. The core of the exploit lies in how Magento handles template rendering, particularly within the context of transactional emails, such as those triggered by payment failures. Attackers can craft malicious input that, when processed by the template engine, leads to arbitrary code execution on the server. This is not a simple injection; it leverages the legitimate templating system to achieve a devastating outcome.

Magento's templating system, often using technologies like PHP's built-in templating or more advanced engines, allows for dynamic content generation within emails. This is essential for personalization, displaying order details, customer information, and error messages. However, if user-supplied data or specially crafted input is not rigorously sanitized before being passed to the template engine, it can be interpreted as executable code. In the case of CVE-2026-75650, the vulnerability is triggered when a payment fails. The system attempts to generate an email notification to the customer, and if the attacker has control over certain data points that are then rendered within this email's template, they can inject malicious code. This code then gets processed by the server's template rendering engine, leading to RCE.

Think of it like a chef using a recipe that calls for a specific spice. If an attacker can sneak in a note that says, "Instead of paprika, use this vial of 'instant-explosion powder' and mix it directly into the main ingredients," and the chef blindly follows that note without checking the vial's label, the result is catastrophic. The template engine, in this analogy, is the chef, and the malicious input is the attacker's note.

The Attack Vector: Payment Failure Emails

The specific vector exploited by the StyleSmuggler campaign is particularly insidious. Payment failures are common occurrences in e-commerce. When a customer's payment doesn't go through, an automated email is typically sent to inform them and prompt them to update their payment details. Attackers have found a way to manipulate the data that populates these emails. By injecting specially crafted strings into fields that are subsequently rendered by the template engine in the payment failure email, they can trigger the RCE. This means that even a legitimate, albeit failed, transaction can become the conduit for a server compromise. The unauthenticated nature of this vulnerability is particularly concerning, as it does not require attackers to log in or possess any special privileges on the Magento store. Any interaction that can trigger a payment failure email, and subsequently influence its content, can potentially be weaponized.

The sophistication lies in understanding the template rendering chain. Attackers need to know which data fields are susceptible, how they are processed by the template engine, and what specific payloads will achieve code execution. This often involves extensive reverse-engineering of the application's code and understanding its dependencies. The fact that this exploit targets a common, automated transactional email makes it highly scalable and difficult to detect through standard security monitoring that might focus on login attempts or direct web requests.

Mitigation and Remediation

Adobe's release of VULN-39341 is the primary mitigation. Merchants running affected versions of Adobe Commerce and Magento Open Source must apply this hotfix immediately. However, simply applying the patch is not sufficient if the store was compromised prior to the hotfix. Attackers who successfully exploited CVE-2026-75650 would have likely established a persistent foothold on the server, potentially by installing backdoors or other malicious code. Therefore, a comprehensive security audit is crucial for any store that was vulnerable during the exploitation window.

This audit should include:

• Verifying the application of the hotfix.
• Scanning for known malware and backdoors.
• Reviewing server logs for suspicious activity, particularly around the time of exploitation (early September 2026).
• Checking for unauthorized file modifications or new user accounts.
• Ensuring that no sensitive data has been exfiltrated.

For stores that were compromised, a full system restore from a known clean backup, coupled with a thorough investigation to understand the extent of the breach, is recommended. The fact that the vulnerability is in the CISA KEV catalog means federal agencies are mandated to patch it, highlighting its severity and the potential for widespread impact.

Broader Implications

CVE-2026-75650 underscores a persistent challenge in e-commerce security: the complex interplay between dynamic content generation, templating engines, and user-supplied data. As platforms evolve to offer more personalized experiences, the attack surface for template injection vulnerabilities can expand. This incident serves as a stark reminder that even seemingly innocuous transactional emails can become vectors for sophisticated attacks. Developers and security teams must maintain vigilance, ensuring that all input, regardless of its source or intended use, is properly validated and neutralized before being rendered or processed by sensitive system components. The StyleSmuggler campaign’s success also highlights the growing sophistication of threat actors targeting e-commerce platforms, often operating with an acute understanding of specific application vulnerabilities.