CVE-2026-75650

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9 Adobe Commerce B2B versions 1.3.3 through 1.5.3 Magento Open Source versions 2.4.4 through 2.4.9

Description Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by a critical template-engine injection issue. An unauthenticated remote attacker can execute arbitrary code in the context of the application service user without any user interaction. The attack occurs in two stages: first, the attacker poisons the system by sending malicious content through attacker-controlled styles properties in an unauthenticated request, which is then stored in a record or report. Second, the attacker triggers a server-side rendering workflow, such as a failed-payment notification, causing the template engine to evaluate the stored data as executable PHP code.

Real-world exploitation has been confirmed since September 4, 2026. Attackers have used this to deploy Rust-based backdoors, PHP web shells, and credit card skimmers. Technical details include the use of the /paypal/transparent/response/ endpoint to smuggle PHP into var/report/ and the use of /graphql requests with malicious styles parameters to trigger execution. Post-exploitation activity includes masquerading processes as fc-cache, chronyd, or kworker/u:8:0 and exfiltrating data via DNS queries.

Recommendations For Adobe Commerce, Adobe Commerce B2B, and Magento Open Source versions 2.4.4 through 2.4.9 and 1.3.3 through 1.5.3: