In vulnerability scoring, CVSS 10.0 is the "we're out of numbers, please stop" tier. It means no login required, no user interaction needed, and total compromise on the other end. Magento and Adobe Commerce just spent three days hosting exactly that, live, in production, on real stores.
The Bug That Emails Itself Into Your Server
Researchers at Sansec disclosed CVE-2026-75650, nicknamed StyleSmuggler, a remote code execution flaw hitting every current version of Magento Open Source and Adobe Commerce, plus Adobe Commerce B2B. The attack is genuinely sneaky: it poisons PHP code through the platform's template system, then detonates it via Magento's own "Payment Transaction Failed Reminder" email — a feature every store already has turned on.
Active exploitation started September 4. The first confirmed victim was running a version with July and August patches fully applied, which means "I patched last month" was not a safe harbor. Attackers used the hole to drop a Rust-based Linux backdoor and a PHP web shell. Adobe finally shipped an emergency hotfix on September 7 at priority 1, its highest urgency rating.
Unauthenticated Means Anyone With WiFi
No login, no phishing email, no social engineering — just an attacker who knows the flaw exists and a store that hasn't patched yet. That's the nightmare combination for e-commerce security: a critical vulnerability with a three-day head start and a patch that landed after real stores were already backdoored.
The detail that should worry site owners most isn't the CVSS score, it's that fully patched-as-of-last-month stores still got popped. Patch cadence alone isn't a security strategy when zero-days show up between patch cycles — you also need monitoring that catches the backdoor Adobe's fix didn't exist yet to prevent.
If your store runs on Magento or Adobe Commerce, patching today is the bare minimum — assume compromise and go hunting for backdoors, too.
Not sure if your platform's been quietly compromised or just want a second set of eyes on your store's security posture, our free supply-chain security checklist is a solid place to start.
Source: Sansec