security_identifier

CVE-2026-75650

Catalogue identifier for a CVSS 10.0 code-execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, reached through the platform's email template processing.

Known aliases

StyleSmuggler

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Attacker PHP executes when Magento renders its failed-payment reminder email

Adobe shipped the out-of-band hotfix on September 8. Sansec dates exploitation to September 4, and that four-day gap is why the advisory pairs the patch with a required encryption-key rotation.

Publishers:dev.to

Reality

Evidence60
Adoption35
Hype gap+15
Incentives65

security1 publisher

StyleSmuggler turns a Magento payment-reminder email into unauthenticated code execution

CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.

Publishers:thehackernews.com

Reality

Evidence70
Adoption55