CISA Includes Adobe Commerce Zero-Day CVSS 10 in Active Exploitation Catalog, with Rust Backdoor Live Since September 4
StyleSmuggler was added to CISA's KEV catalog on September 8. It is an unauthenticated RCE, CVSS 10, in the Magento template engine, with a Rust backdoor disguised as an NTP server.
On September 8, CISA added CVE-2026-75650, dubbed StyleSmuggler, to its Known Exploited Vulnerabilities catalog. The vulnerability is an unauthenticated remote code execution in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, with a CVSS score of 10.0, and has been actively exploited since September 4, three days before Adobe released the hotfix VULN-39341 on September 7.
The technique is elegant and therefore dangerous. According to Sansec, which reported the activity, an unauthenticated caller can smuggle PHP into the Magento template engine through style properties and force its execution when the server renders the "Payment Transaction Failed Reminder" email. The trigger is a transactional message that the platform sends automatically, without customer interaction. No login, no cart, no checkout.
Rust Backdoor, C2 Disguised as NTP
Attackers are deploying a Rust backdoor for Linux and PHP web shells in the compromised stores. The command and control channel masquerades as an NTP server, which means UDP traffic on port 123 communicating with a host that goes unnoticed in any superficial firewall log analysis. For security operations, this represents the worst kind of noise: a legitimate protocol covering a bridge for exfiltration and persistent command. Sansec notes that persistence is easily recoverable even after a patch if the cleanup did not remove the web shell.
The severity of CVSS 10 has a direct reading: unauthenticated, remote, network vector, no user interaction, with total impact on confidentiality, integrity, and availability. There is no reliable partial mitigation. Adobe's recommendation is to apply VULN-39341, a Composer hotfix, and not a complete release update. The point of concern is that many Magento operations run with forks and third-party modules that break on rebase.
Where Exposure Really Hurts
The global installed base of Magento exceeds 200,000 active stores, with a heavy concentration in mid-sized retail in Europe and the United States. Brands like Coca-Cola, Ford, and Nike have operated storefronts on Magento at some point; today the typical base consists of European and American retailers who rely on integrators. The United States accounts for about 30% of the Magento market according to BuiltWith, with Germany and the United Kingdom in the second block. For these operations, the exploit arrives ahead of the response team.
Brazil appears second due to the size of the Magento base in the national e-commerce sector. Magazine Luiza, Renner, and Riachuelo have had or currently operate on the stack, and a significant portion of the long tail of Brazilian B2B storefronts operates with Adobe Commerce or Magento Open Source served by local integrators. The exposure is not hypothetical: a Rust binary disguised in NTP bypasses perimeter firewalls configured by default at national providers like Locaweb and KingHost, which host a large portion of this tail.
Adobe had not commented on the origin of the attacks by the time this article was published. CISA set September 29 as the deadline for U.S. federal agencies to apply the patch, a three-week window that reflects the urgency but also the reality of patching in commercial production.
The Detail Most Coverage Missed
The execution trigger is a transactional email, and this changes the defense surface. WAF rules that filter POST requests on /checkout or /admin do not see the exploitation take place because the payload travels through the template rendering path on the server side. Teams that rely solely on edge protection become blind. The real priority, beyond the patch, is to audit the storefront for web shells already planted between September 4 and 8, the interval during which exploitation ran without a public fix available.