CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | Akamai
StyleSmuggler (CVE-2026-75650) is a CVSS 10.0 unauthenticated RCE in Adobe Commerce and Magento, actively exploited since September 2026 via PHP code injection through GraphQL headers. Attackers inject PHP code into Magento's template engine by smuggling payloads via GraphQL HTTP headers and parameters. Magento logs the payload, which executes when transactional email rendering loads the poisoned log file. Apply Adobe hotfix APSB26-146 immediately.
Detection / Hunteropenrouter
Immediate Actions
- Apply Adobe hotfix APSB26-146 (VULN-39341) to all affected instances immediately
- Block PHP code patterns in GraphQL HTTP headers at WAF layer
- Restrict internet exposure of Magento GraphQL endpoints where possible
Key Takeaways
- CVSS 10.0; no authentication or user interaction required to exploit
- Actively exploited in the wild since early September 2026
- Affected: Adobe Commerce/Magento 2.4.4 through 2.4.9, Commerce B2B 1.3.3 through 1.5.3
- Adobe released out-of-band hotfix APSB26-146 (VULN-39341) for remediation
- No public weaponized proof-of-concept observed as of writing
Attack Chain
- Initial Access: Attacker sends GraphQL request with PHP code hidden in HTTP header or parameter
- Persistence: Magento logs unrecognized value, storing PHP code in server-side log file
- Execution: Follow-up request triggers template engine via transactional email generation
- Impact: Template engine loads poisoned log file and executes embedded PHP code, granting RCE
Affected Systems
- Adobe Commerce versions 2.4.4 through 2.4.9
- Magento Open Source versions 2.4.4 through 2.4.9
- Adobe Commerce B2B versions 1.3.3 through 1.5.3
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-75650 | Adobe Commerce / Magento Open Source template engine | Critical | Unauthenticated PHP code injection via template engine leading to remote code execution. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Server-side PHP execution via template engine; EDR may not inspect web app internals. |
| Network Visibility | Medium | GraphQL requests with PHP in headers visible at WAF or reverse proxy layer. |
| Detection Difficulty | Moderate | Payload hidden in HTTP headers; template rendering trigger is indirect and delayed. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| GraphQL API requests containing PHP open tags or eval calls in HTTP headers or parameters (T1190). | WAF logs, GraphQL request logs | Initial Access | Low — PHP tags in GraphQL headers are abnormal |
| Magento template engine loading log files during email rendering triggers PHP execution (T1059). | Application logs, file access logs | Execution | Medium — legitimate template rendering may access logs |
Required Log Sources
- Web server access logs
- GraphQL API request logs
- Magento application logs
- WAF logs
Key Behavioral Indicators
- GraphQL requests with PHP code patterns in HTTP headers
- Unexpected PHP execution during email template rendering
- Magento log files containing PHP open tags
- Transactional email generation triggering server-side code execution
Control Gaps
- Standard WAF rules may not inspect GraphQL header values for PHP patterns
- EDR lacks visibility into Magento template engine internals
- Log file integrity monitoring may not flag poisoned log entries
- No detection for delayed execution via email rendering trigger
False Positive Assessment
Low — PHP code in GraphQL HTTP headers is abnormal under normal usage
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy WAF rules inspecting GraphQL headers and parameters for PHP injection
- Enable Magento log file integrity monitoring for PHP content
- Isolate Magento application servers from non-essential network access
User Protection
- Monitor transactional email generation for anomalous server-side behavior
- Audit Magento application and system logs for unexpected PHP execution
MITRE ATT&CK Mapping
Initial Access
Execution
Stealth
Command and Control
Plain-Language Summary
A critical vulnerability in Adobe Commerce and Magento lets attackers run malicious code on servers without needing a password. Attackers hide code in web requests to Magento's API, which gets stored in logs and later executed when the system sends emails. Organizations running affected versions should apply Adobe's emergency patch immediately.
- cveCVE-2026-75650Unauthenticated PHP code injection via template engine leading to remote code execution.