Security2 publishers2 min readPublished Updated
Attackers have been planting web shells on Magento stores since September 4
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
The Watch · Security desk
What happened
- CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation: one in Adobe Commerce and Magento, two in Windows, and one in N-able N-central.
- Sansec says CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw it calls StyleSmuggler, has been exploited since September 4 to deploy web shells and backdoors on online stores.
- Sansec puts current Magento Open Source releases in scope, naming 2.4.7, 2.4.8 and 2.4.9 among the affected versions.
- The federal due date for the Magento and N-able flaws is September 11, 2026, eleven days ahead of the September 22 date CISA set for the two Windows privilege-escalation bugs.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Any storefront that was reachable during the exploitation window has to be treated as possibly already carrying an implant, because the update shuts the door behind whatever came through it.
- decision For federal agencies the ticket no longer closes on patch evidence alone; BOD 26-04 makes the question of whether the box was already compromised part of the required work.
- contradiction The two sources invoke different binding directives, and the difference changes what is owed: a fix by the due date under 22-01, versus risk-ranked remediation plus a compromise check under 26-04.
- constraint Merchants outside the federal branch inherit the same exploitation with no deadline attached, so the scheduling call sits entirely with whoever owns the storefront.
The chain has two stages and they need not be adjacent in time. Sansec describes a first stage that creates or poisons a record, dropping PHP into Magento's templating path, and a second stage in which a routine email-rendering process evaluates that template and the code runs [5]. The first stage needs no credentials [2]. Because execution happens inside the platform's own mail rendering, the timestamp on the compromise belongs to the store's email job rather than to the attacker's request [6], which is where log review tends to go wrong on this class of bug.
Seven days separate the start of known exploitation from the federal due date for this CVE [1]. Any storefront that was reachable across that window and gets patched afterwards still owes an answer on what was left behind: the update removes the injection path, and a web shell dropped before the update is unaffected by it [4].
Neither source names a fixed Magento release or a mitigation for CVE-2026-75650, while Security Affairs does record N-able shipping an emergency hotfix for its own CVSS 10.0 pre-auth code injection flaw, CVE-2026-86218 [5][8]. Sansec's affected list includes 2.4.9 [4]. So the remediation instruction for merchants is, on the published evidence, incomplete.
The two sources also point at different directives. CISA's alert grounds the requirement in BOD 26-04, which tells FCEB agencies to prioritize KEV CVEs on publicly exposed assets that grant total control after exploitation, defer the lower-risk ones, and check whether the system was compromised before the patch went on [10]. Security Affairs frames the same additions under BOD 22-01 and its due dates [12]. For a bug whose observed payload is a web shell [3], the 26-04 clause that matters is the pre-patch compromise check.
Eleven days sit between the two due dates in this batch [2], and that gap is the prioritization written as arithmetic: two unauthenticated remote code execution flaws at CVSS 10.0 on internet-reachable software go first [3], the two local privilege escalations at 7.8 go second [6][7]. One of those is the first Windows Update Stack vulnerability Microsoft has confirmed as exploited [6]. It is a second-half-of-the-intrusion problem, and CISA has priced it that way.
For a store on 2.4.7, 2.4.8 or 2.4.9 [4], the useful search is for template records containing PHP [5] and for files the web user wrote on or after September 4 [3].
What to watch
- Whether Adobe or Sansec publishes a patched version number or mitigation for 2.4.7, 2.4.8 and 2.4.9, which the sources currently do not name.
- Whether CISA issues supplemental guidance on how FCEB agencies satisfy the BOD 26-04 pre-patch compromise check for a web shell payload.
- Whether the first confirmed exploitation of a Windows Update Stack flaw, CVE-2026-81963, gets attributed to a named actor.