Adobe Releases Emergency Hotfix for 10.0 Vulnerability in Magento and Adobe Commerce

An Out-of-Schedule Patch

Adobe published bulletin APSB26-146 at 8:20 PM UTC on September 7, with a priority rating of 1, the highest from the manufacturer. The document acknowledges CVE-2026-75650 in Magento Open Source, Adobe Commerce, and Adobe Commerce B2B, with a CVSS score of 10.0. The vulnerability allows for unauthenticated remote code execution in any version from 2.4.4 to 2.4.9, including builds with all mandatory security patches from August applied.

The fix is not a new version. It is hotfix VULN-39341, distributed as a composer package, which merchants must download from repo.magento.com and apply to their current installation. Running composer update to upgrade to the next stable release does not resolve the issue. Adobe’s official quarterly cycle remains scheduled for October.

How the Exploit Survived Patching

Dutch firm Sansec, which has tracked intrusions in Magento stores for over a decade, named the attack family StyleSmuggler and issued the first notice on September 5. The team rebuilt the complete chain on clean installations of versions 2.4.7, 2.4.8, and 2.4.9. The first identified victim was running Magento 2.4.6-p15 with July and August patches installed: being up-to-date with the official schedule did not protect the store.

The technique exploits the dependency scanner within setup/src/Magento/Setup/Module/Di/Code/, a component designed to compile code during deployment via the command line. Three methods within that scanner never had context restrictions: an HTTP request can trigger the same file inclusion that a developer would initiate from the terminal. The attacker injects PHP code through the styles property, bypassing type validations of the injector, and causes the server to execute the payload during the rendering of a payment failure email. According to Sansec's surface survey, around 111,000 Magento stores are publicly exposed globally.

What Adobe Recommends After the Hotfix

The bulletin advises merchants assuming that the store's encryption key is compromised. Adobe requests mandatory rotation of administrative passwords, REST/SOAP/GraphQL tokens, OAuth secrets, payment gateway credentials, database credentials, SSH keys, and third-party extension keys. The company did not disclose the number of stores effectively compromised, and no establishments were named by the time this article was published.

Reading for Different Markets

The Magento ecosystem is global, and the operational consequences vary by market. In the United States, where the platform is the backbone for thousands of D2C brands and stores connected to operators like Adobe Experience Manager, the hotfix arrives amid preparations for the year-end sales season. Platform teams running Adobe Commerce Cloud will find out in the next maintenance window whether multi-tenant merchants can apply the composer patch without breaking customizations.

In Germany and the United Kingdom, the vector carries different weight. German and British e-commerce networks run Magento extensively for B2B catalogs, and the Adobe Commerce B2B versions 1.3.3 to 1.5.3 are also listed in the bulletin. The timeline is worsened for another reason: any entity suffering customer data exfiltration today enters a mandatory notification window under GDPR within 72 hours, with the Irish supervisor and the ICO already monitoring the wave following the first reports from merchants.

In Brazil, Magento continues to be one of the most adopted platforms among medium-sized brands that have transitioned from proprietary SaaS platforms. Local integrators manage ecosystems with hundreds of instances, and the guidance on credential rotation directly impacts gateway keys such as Pagar.me, Cielo, and Rede. The reliance on community extensions increases the cost of sanity checks: each module needs to be re-audited before rotating the API token.

What Remains for the Next Maintenance

Applying the hotfix addresses the emergency, not the root. The component that opened the door has existed since the old compilation architecture, survived the migration to 2.x, and has never been interpreted as a public surface. Adobe has not indicated whether it plans to remove the HTTP route in the October quarterly cycle or simply maintain the filter added today. In the meantime, any merchant running composer update without applying VULN-39341 will remain exposed the day after installing the next release.