The CVE-2026-75650 patch is now available from Adobe for affected Adobe Commerce and Magento Open Source deployments. Adobe published security bulletin APSB26-146 on September 7, 2026, rates the vulnerability Critical with a CVSS score of 10.0, says authentication is not required for exploitation and confirms that CVE-2026-75650 has been exploited in the wild.
Direct answer: If your deployment falls within Adobe’s affected-version table, follow Adobe’s current hotfix guidance now. But treat patch status and compromise status as two separate questions. Successful remediation closes the known vulnerability; it does not prove that an attacker did not exploit the store before the hotfix was installed.
CVE-2026-75650 patch: what changed on September 7
The important change is not simply that another critical CVE was disclosed. Before Adobe’s bulletin, StyleSmuggler was being investigated as an actively exploited Magento and Adobe Commerce zero-day without an official Adobe fix. Adobe’s September 7 bulletin changed that state by providing an official security update for CVE-2026-75650 and formally confirming exploitation in the wild.
That means older guidance focused only on temporary mitigation is no longer the complete answer. Operators now have an official remediation path, while the earlier exposure period remains relevant for incident investigation.
Which Adobe Commerce and Magento versions are affected?
Adobe’s APSB26-146 affected-version table includes Adobe Commerce release lines through 2.4.9-2026-aug and earlier, older 2.4.8, 2.4.7, 2.4.6, 2.4.5 and 2.4.4 lines as listed by Adobe, Adobe Commerce B2B release lines listed in the bulletin, and Magento Open Source through 2.4.9-2026-aug and earlier listed release lines.
Operators should compare their exact deployment against Adobe’s current affected-version table rather than relying on a shortened version list from a news article, because Adobe’s bulletin is the controlling source for supported product and release details.
Why CVE-2026-75650 is an urgent operator issue
Adobe describes CVE-2026-75650 as an improper neutralization issue in a template engine that can result in arbitrary code execution. The bulletin marks the flaw Critical, gives it a CVSS 3.1 base score of 10.0 and says credentials are not required to exploit it.
More importantly, exploitation is not hypothetical. Adobe says it is aware of exploitation in the wild. Sansec, which tracks the campaign under the name StyleSmuggler, reported the first confirmed exploitation on September 4 and subsequently documented malicious processes, persistence behaviour and additional attacker activity during its developing investigation.
What affected operators should do now
1. Verify whether your deployment is affected. Match the exact Adobe Commerce, Adobe Commerce B2B or Magento Open Source version against Adobe’s current APSB26-146 table.
2. Apply Adobe’s official remediation. Use the hotfix and installation guidance supplied by Adobe for CVE-2026-75650 rather than continuing to rely only on emergency pre-patch workarounds.
3. Verify the expected patched state. Confirm that the Adobe-recommended remediation was successfully applied using the verification method supported for your deployment and patch process.
4. Assess possible pre-patch compromise separately. If the store was internet-accessible while vulnerable, review relevant system, application and security evidence for signs of exploitation. Do not treat the presence or absence of one published indicator as a complete compromise determination.
5. Escalate when compromise evidence exists. Suspicious processes, persistence, unexpected web-access patterns, malicious files or other incident evidence should move the case from vulnerability remediation into incident response.
Does installing the patch mean the store is clean?
No. Patching and compromise verification answer different questions.
The hotfix addresses the vulnerability that enables exploitation. A compromise investigation asks whether the vulnerability was successfully exploited before that remediation was applied and whether attacker-controlled persistence or other malicious changes remain.
This distinction matters because Sansec observed exploitation before Adobe’s official hotfix became available. Its investigation reported malicious background processes masquerading under system-like names, persistence mechanisms and, on September 7, a separate attacker dropping a PHP web shell.
Those observations do not mean every vulnerable Magento installation was compromised. They establish that real compromises occurred and that patching alone cannot retrospectively establish a clean pre-patch history.
What compromise evidence has been observed?
Sansec’s developing investigation has published indicators associated with observed StyleSmuggler incidents, including suspicious background processes, filesystem locations, persistence behaviour, attack-request patterns and later variants using different process names. It also reported a second, unrelated attacker dropping a PHP web shell on September 7.
These indicators can support an investigation, but they should not be treated as an exhaustive definition of compromise. Threat actors can change filenames, persistence locations, infrastructure and payloads, and the published Sansec research itself was being updated as new evidence appeared.
What if none of the published indicators are present?
Absence of a known indicator does not by itself prove that the store was never compromised. Published indicators describe evidence observed in known incidents; they are not a universal test capable of proving every deployment clean.
For a high-consequence environment, the stronger question is whether available logs, filesystem evidence, process history, credentials, deployment history and other incident-response evidence support or contradict successful exploitation during the exposure window.
What is confirmed and what remains unknown?
Confirmed: Adobe published APSB26-146 on September 7; CVE-2026-75650 can lead to arbitrary code execution; authentication is not required; Adobe rates it Critical with CVSS 10.0; Adobe has released an official hotfix; and Adobe confirms exploitation in the wild.
Also reported from direct threat research: Sansec observed exploitation beginning September 4 and documented multiple malicious-process and persistence states during its investigation.
Still unresolved: there is no verified authoritative global victim count in the reviewed evidence, India-specific exposure is unknown, the full attacker population and complete IOC set may continue to evolve, and this article does not establish whether any individual store has or has not been compromised.
What should operators monitor next?
The key follow-up signals are revisions to Adobe’s APSB26-146 or hotfix guidance, additional compromise indicators from direct incident research, material changes in affected-version guidance, and advisories from national cybersecurity authorities. Any new evidence of broader exploitation or post-remediation persistence would materially change the operational answer and should trigger another review.
Verification note: ThePulseSignal reviewed Adobe’s September 7 APSB26-146 security bulletin as the controlling vendor source and cross-checked the active-exploitation timeline and observed compromise evidence against Sansec’s direct threat-research investigation.
