Critical Magento Vulnerability CVE-2026-75650: Rust Backdoor and PHP Web Shell
- Severity
- CRITICAL
- CVSS
- 10
- Affected component
- magento (npm)
- Affected versions
- >= 2.4.4-NA, <= 2.4.4-NA or >= 2.4.4-p1, <= 2.4.4-p1 or >= 2.4.4-p10, <= 2.4.4-p10 or >= 2.4.4-p11, <= 2.4.4-p11 or >= 2.4.4-p12, <= 2.4.4-p12 or >= 2.4.4-p13, <= 2.4.4-p13 or >= 2.4.4-p2, <= 2.4.4-p2 or >= 2.4.4-p3, <= 2.4.4-p3 or >= 2.4.4-p4, <= 2.4.4-p4 or >= 2.4.4-p5, <= 2.4.4-p5 or >= 2.4.4-p6, <= 2.4.4-p6 or >= 2.4.4-p7, <= 2.4.4-p7 or >= 2.4.4-p8, <= 2.4.4-p8 or >= 2.4.4-p9, <= 2.4.4-p9 or >= 2.4.5-NA, <= 2.4.5-NA or >= 2.4.5-p1, <= 2.4.5-p1 or >= 2.4.5-p10, <= 2.4.5-p10 or >= 2.4.5-p11, <= 2.4.5-p11 or >= 2.4.5-p12, <= 2.4.5-p12 or >= 2.4.5-p13, <= 2.4.5-p13 or >= 2.4.5-p14, <= 2.4.5-p14 or >= 2.4.5-p2, <= 2.4.5-p2 or >= 2.4.5-p3, <= 2.4.5-p3 or >= 2.4.5-p4, <= 2.4.5-p4 or >= 2.4.5-p5, <= 2.4.5-p5 or >= 2.4.5-p6, <= 2.4.5-p6 or >= 2.4.5-p7, <= 2.4.5-p7 or >= 2.4.5-p8, <= 2.4.5-p8 or >= 2.4.5-p9, <= 2.4.5-p9 or >= 2.4.6-NA, <= 2.4.6-NA or >= 2.4.6-p1, <= 2.4.6-p1 or >= 2.4.6-p10, <= 2.4.6-p10 or >= 2.4.6-p11, <= 2.4.6-p11 or >= 2.4.6-p12, <= 2.4.6-p12 or >= 2.4.6-p13, <= 2.4.6-p13 or >= 2.4.6-p2, <= 2.4.6-p2 or >= 2.4.6-p3, <= 2.4.6-p3 or >= 2.4.6-p4, <= 2.4.6-p4 or >= 2.4.6-p5, <= 2.4.6-p5 or >= 2.4.6-p6, <= 2.4.6-p6 or >= 2.4.6-p7, <= 2.4.6-p7 or >= 2.4.6-p8, <= 2.4.6-p8 or >= 2.4.6-p9, <= 2.4.6-p9 or >= 2.4.7-NA, <= 2.4.7-NA or >= 2.4.7-b1, <= 2.4.7-b1 or >= 2.4.7-b2, <= 2.4.7-b2 or >= 2.4.7-beta3, <= 2.4.7-beta3 or >= 2.4.7-p3, <= 2.4.7-p3 or >= 2.4.7-p4, <= 2.4.7-p4 or >= 2.4.7-p5, <= 2.4.7-p5 or >= 2.4.7-p6, <= 2.4.7-p6 or >= 2.4.7-p7, <= 2.4.7-p7 or >= 2.4.7-p8, <= 2.4.7-p8 or >= 2.4.8-NA, <= 2.4.8-NA or >= 2.4.8-beta1, <= 2.4.8-beta1 or >= 2.4.8-beta2, <= 2.4.8-beta2 or >= 2.4.8-p1, <= 2.4.8-p1 or >= 2.4.8-p2, <= 2.4.8-p2 or >= 2.4.8-p3, <= 2.4.8-p3 or >= 2.4.9-alpha1, <= 2.4.9-alpha1 or >= 2.4.9-alpha2, <= 2.4.9-alpha2 or >= 2.4.9-alpha3, <= 2.4.9-alpha3 or >= 2.4.9-beta1, <= 2.4.9-beta1 or >= 2.2.0-RC1.3, <= 2.2.0-RC1.3 or >= 2.2.0-RC1.2, <= 2.2.0-RC1.2 or >= 2.2.0-RC1.1, <= 2.2.0-RC1.1 or >= 2.1.0, <= 2.1.0 or >= 2.1.0-rc3, <= 2.1.0-rc3 or >= 2.1.0-rc2, <= 2.1.0-rc2 or >= 2.1.0-rc1, <= 2.1.0-rc1 or >= 2.0.0, <= 2.0.0 or >= 2.0.0-rc, <= 2.0.0-rc or >= 0.74.0-beta1, <= 0.74.0-beta1 or >= 0.42.0-beta3, <= 0.42.0-beta3 or >= 0.1.0-alpha108, <= 0.1.0-alpha108 or >= 0.42.0-beta1, <= 0.42.0-beta1 or >= 0.1.0-alpha107, <= 0.1.0-alpha107 or >= 0.1.0-alpha106, <= 0.1.0-alpha106 or >= 0.1.0-alpha105, <= 0.1.0-alpha105 or >= 0.1.0-alpha104, <= 0.1.0-alpha104 or >= 0.1.0-alpha103, <= 0.1.0-alpha103 or >= 0.1.0-alpha102, <= 0.1.0-alpha102 or >= 0.1.0-alpha101, <= 0.1.0-alpha101 or >= 0.1.0-alpha100, <= 0.1.0-alpha100 or >= 0.1.0-alpha99, <= 0.1.0-alpha99 or >= 0.1.0-alpha98, <= 0.1.0-alpha98 or >= 0.1.0-alpha97, <= 0.1.0-alpha97 or >= 0.1.0-alpha96, <= 0.1.0-alpha96 or >= 0.1.0-alpha95, <= 0.1.0-alpha95 or >= 0.1.0-alpha94, <= 0.1.0-alpha94 or >= 0.1.0-alpha93, <= 0.1.0-alpha93 or >= 0.1.0-alpha92, <= 0.1.0-alpha92 or >= 0.1.0-alpha91, <= 0.1.0-alpha91 or >= 0.1.0-alpha90, <= 0.1.0-alpha90 or >= 0.1.0-alpha89, <= 0.1.0-alpha89
- Patched version
- Not yet available
Adobe Commerce and Magento Open Source have a critical flaw, tracked as CVE-2026-75650, that has been actively exploited in the wild. The vulnerability allows for the deployment of a Rust backdoor and PHP web shell.
What happened
Adobe has confirmed a critical vulnerability in Adobe Commerce and Magento Open Source, identified as CVE-2026-75650. This flaw, codenamed StyleSmuggler, has been actively exploited in the wild to deploy a Rust backdoor and a PHP web shell. The vulnerability allows attackers to inject PHP code into Magento's template system, triggering arbitrary code execution. Adobe has released patches to address this issue, and it is recommended that users upgrade to the latest version of Magento and review their environments for any signs of compromise.
The exploit takes advantage of Magento's template system through PHP code injection to generate a 'Payment Transaction Failed Reminder' email, which then triggers code execution. This vulnerability affects a wide range of Magento versions, from 2.4.4-NA to 2.4.9-alpha3, and earlier versions. Adobe has provided a hotfix available for download to mitigate the vulnerability.
What to do about it
- Upgrade to the latest version of Magento to ensure you have the necessary patches.
- Apply the VULN-39341 patch provided by Adobe to address the vulnerability.
- Rotate your encryption keys as part of the mitigation process.
- Review your Magento environments for any signs of compromise, such as unusual 'Payment Transaction Failed Reminder' emails.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
magento is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Magento versions >= 2.4.4-NA, <= 2.4.4-NA or >= 2.4.4-p1, <= 2.4.4-p1 or >= 2.4.4-p10, <= 2.4.4-p10 or >= 2.4.4-p11, <= 2.4.4-p11 or >= 2.4.4-p12, <= 2.4.4-p12 or >= 2.4.4-p13, <= 2.4.4-p13 or >= 2.4.4-p2, <= 2.4.4-p2 or >= 2.4.4-p3, <= 2.4.4-p3 or >= 2.4.4-p4, <= 2.4.4-p4 or >= 2.4.4-p5, <= 2.4.4-p5 or >= 2.4.4-p6, <= 2.4.4-p6 or >= 2.4.4-p7, <= 2.4.4-p7 or >= 2.4.4-p8, <= 2.4.4-p8 or >= 2.4.4-p9, <= 2.4.4-p9 or >= 2.4.5-NA, <= 2.4.5-NA or >= 2.4.5-p1, <= 2.4.5-p1 or >= 2.4.5-p10, <= 2.4.5-p10 or >= 2.4.5-p11, <= 2.4.5-p11 or >= 2.4.5-p12, <= 2.4.5-p12 or >= 2.4.5-p13, <= 2.4.5-p13 or >= 2.4.5-p14, <= 2.4.5-p14 or >= 2.4.5-p2, <= 2.4.5-p2 or >= 2.4.5-p3, <= 2.4.5-p3 or >= 2.4.5-p4, <= 2.4.5-p4 or >= 2.4.5-p5, <= 2.4.5-p5 or >= 2.4.5-p6, <= 2.4.5-p6 or >= 2.4.5-p7, <= 2.4.5-p7 or >= 2.4.5-p8, <= 2.4.5-p8 or >= 2.4.5-p9, <= 2.4.5-p9 or >= 2.4.6-NA, <= 2.4.6-NA or >= 2.4.6-p1, <= 2.4.6-p1 or >= 2.4.6-p10, <= 2.4.6-p10 or >= 2.4.6-p11, <= 2.4.6-p11 or >= 2.4.6-p12, <= 2.4.6-p12 or >= 2.4.6-p13, <= 2.4.6-p13 or >= 2.4.6-p2, <= 2.4.6-p2 or >= 2.4.6-p3, <= 2.4.6-p3 or >= 2.4.6-p4, <= 2.4.6-p4 or >= 2.4.6-p5, <= 2.4.6-p5 or >= 2.4.6-p6, <= 2.4.6-p6 or >= 2.4.6-p7, <= 2.4.6-p7 or >= 2.4.6-p8, <= 2.4.6-p8 or >= 2.4.6-p9, <= 2.4.6-p9 or >= 2.4.7-NA, <= 2.4.7-NA or >= 2.4.7-b1, <= 2.4.7-b1 or >= 2.4.7-b2, <= 2.4.7-b2 or >= 2.4.7-beta3, <= 2.4.7-beta3 or >= 2.4.7-p3, <= 2.4.7-p3 or >= 2.4.7-p4, <= 2.4.7-p4 or >= 2.4.7-p5, <= 2.4.7-p5 or >= 2.4.7-p6, <= 2.4.7-p6 or >= 2.4.7-p7, <= 2.4.7-p7 or >= 2.4.7-p8, <= 2.4.7-p8 or >= 2.4.8-NA, <= 2.4.8-NA or >= 2.4.8-beta1, <= 2.4.8-beta1 or >= 2.4.8-beta2, <= 2.4.8-beta2 or >= 2.4.8-p1, <= 2.4.8-p1 or >= 2.4.8-p2, <= 2.4.8-p2 or >= 2.4.8-p3, <= 2.4.8-p3 or >= 2.4.9-alpha1, <= 2.4.9-alpha1 or >= 2.4.9-alpha2, <= 2.4.9-alpha2 or >= 2.4.9-alpha3, <= 2.4.9-alpha3 or >= 2.4.9-beta1, <= 2.4.9-beta1 or >= 2.2.0-RC1.3, <= 2.2.0-RC1.3 or >= 2.2.0-RC1.2, <= 2.2.0-RC1.2 or >= 2.2.0-RC1.1, <= 2.2.0-RC1.1 or >= 2.1.0, <= 2.1.0 or >= 2.1.0-rc3, <= 2.1.0-rc3 or >= 2.1.0-rc2, <= 2.1.0-rc2 or >= 2.1.0-rc1, <= 2.1.0-rc1 or >= 2.0.0, <= 2.0.0 or >= 2.0.0-rc, <= 2.0.0-rc or >= 0.74.0-beta1, <= 0.74.0-beta1 or >= 0.42.0-beta3, <= 0.42.0-beta3 or >= 0.1.0-alpha108, <= 0.1.0-alpha108 or >= 0.42.0-beta1, <= 0.42.0-beta1 or >= 0.1.0-alpha107, <= 0.1.0-alpha107 or >= 0.1.0-alpha106, <= 0.1.0-alpha106 or >= 0.1.0-alpha105, <= 0.1.0-alpha105 or >= 0.1.0-alpha104, <= 0.1.0-alpha104 or >= 0.1.0-alpha103, <= 0.1.0-alpha103 or >= 0.1.0-alpha102, <= 0.1.0-alpha102 or >= 0.1.0-alpha101, <= 0.1.0-alpha101 or >= 0.1.0-alpha100, <= 0.1.0-alpha100 or >= 0.1.0-alpha99, <= 0.1.0-alpha99 or >= 0.1.0-alpha98, <= 0.1.0-alpha98 or >= 0.1.0-alpha97, <= 0.1.0-alpha97 or >= 0.1.0-alpha96, <= 0.1.0-alpha96 or >= 0.1.0-alpha95, <= 0.1.0-alpha95 or >= 0.1.0-alpha94, <= 0.1.0-alpha94 or >= 0.1.0-alpha93, <= 0.1.0-alpha93 or >= 0.1.0-alpha92, <= 0.1.0-alpha92 or >= 0.1.0-alpha91, <= 0.1.0-alpha91 or >= 0.1.0-alpha90, <= 0.1.0-alpha90 or >= 0.1.0-alpha89, <= 0.1.0-alpha89.
What should I do right now?
Upgrade to the latest version of Magento, apply the VULN-39341 patch, rotate your encryption keys, and review your environments for any signs of compromise.
Has this been exploited in the wild?
Yes, this vulnerability has been actively exploited in the wild.