CVE-2026-75650

Based on the technical breakdown published by Sansec's Forensics Team and Adobe's own bulletin (APSB26-146, Sept 7), here's the architectural shape of this one:

Stage 1: attacker abuses a styles parameter in a GraphQL request to plant PHP inside Magento-generated content (a report/log file), bypassing normal template sanitization. Stage 2: no further action needed — Magento's own workflow renders that content when composing its standard "Payment Transaction Failed Reminder" email, and the code executes server-side at that point.

CVSS 10.0, CWE-1336 (improper neutralization in a template engine), zero auth, zero user interaction. First confirmed exploitation Sept 4, against a store patched through August 2026 with a clean security:patch-status . Sansec reproduced the full chain independently on clean 2.4.7/2.4.8/2.4.9.

Post-exploitation payload observed: a Rust backdoor disguised as a kworker process, cron persistence, C2 over TLS WebSocket. Adobe's remediation isn't just "apply the hotfix" — they're telling merchants to rotate the Commerce encryption key and every credential it protected, because patching doesn't undo prior exposure.

One detail I want to flag as unverified: some secondary coverage cites an unnamed "Disrex Group" analysis claiming the injected code rides Magento's DI-compiler class chain to include() the poisoned file. I couldn't find that analysis published anywhere independently, so treat it as single-sourced until Adobe or Sansec confirms.

For context on the background/prior coverage: PaperCut CVE-2026-82078 hit a nearly identical architectural pattern.

Curious how folks running headless/PWA Magento storefronts are threading the needle here — Sansec's interim mitigation (disable GraphQL) isn't viable if your frontend depends on it. Anyone gone with a WAF rule targeting the styles param instead of a full GraphQL block?