Executive Summary

On September 8th, 2026, CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a critical vulnerability in Adobe Commerce and Magento Open Source. The flaw lets an unauthenticated, remote attacker inject and execute arbitrary code through Magento's template engine. Magento is an E-commerce platform, and a compromise could expose confidential client financial data. It could also provide threat actors initial access into an organization’s internal network. It was one of four critical vulnerabilities Adobe addressed across its September 2026 security update cycle involving multiple products.

While CVE-2026-75650 was the most critically scored of the four and the only one in the security update (at time of writing) confirmed to be used in the wild, the other four reported vulnerabilities are also critical. Two of the vulnerabilities were reported in ColdFusion (CVE-2026-48273 and CVE-2026-75746) and provide a threat actor remote code execution through code injection and SQL injection. The fourth vulnerability, CVE-2026-19232, is an authorization weakness in Experience Manager that allows a low-privileged attacker to execute arbitrary code and gain elevated control of another account.

Given the confirmed in-the-wild compromise of Commerce and Magento storefronts, Beazley Security recommends affected organizations apply the CVE-2026-75650 hotfix immediately and conduct a thorough review for any signs of compromise. For ColdFusion and Experience Manager vulnerabilities, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Mitigations / Workarounds

Given active exploitation in the wild, Beazley Security strongly recommends organizations apply updates immediately. Where an upgrade cannot be scheduled immediately, the steps below reduce exposure based on how each vulnerability is reached.

Adobe Commerce and Magento Open Source

Given the confirmed use of CVE-2026-75650 in the wild, the following mitigation steps should be followed out of an abundance of caution:

• 

  Rotate the platform encryption key and every credential it protects, including stored payment configuration, integration tokens, and API credentials.

• 

  Force logout of active administrative sessions and reset administrator credentials after rotating keys.

• 

  Restrict or disable GraphQL endpoints where the storefront does not depend on them, which was the interim containment advice circulated before the hotfix shipped.

• 

  Treat any internet-facing store that was unpatched on or after September 4th 2026 as potentially compromised and investigate before returning it to normal operation.

ColdFusion

Both flaws require an attacker to first authenticate, so the practical mitigation strategy is to limit access:

• 

  Remove the ColdFusion Administrator and any other administrative interface from direct internet exposure and ensure that administrative actions are only possible through trusted or administrative networks.

• 

  Audit ColdFusion accounts and revoke unnecessary high-privilege roles.

• 

  Review application code that builds queries from user-controllable input, particularly cfgridupdate and cfstoredproc calls, and validate table and procedure names before use.

• 

  Tighten deserialization limits in cfserialfilter.txt and use the current MySQL Java connector, both of which Adobe recommends alongside this update.

Experience Manager

Exploitation needs only a low-privileged account, which makes account hygiene the most relevant mitigation:

• 

  Review low-privilege access to author instances and remove unnecessary accounts.

• 

  Limit access to author and administrative instances to trusted networks.

Patches

For CVE-2026-75650, Adobe calls for two separate actions:

• 

  apply the out-of-band hotfix for Adobe Commerce and Magento Open Source

• 

  rotate the platform's encryption key along with any credentials it protects.

Due to confirmed use in-the-wild, organizations that ran an internet-facing, unpatched storefront after September 4th, 2026 should assume compromise and hunt for indicators rather than rely on a clean patch level as proof of safety. Affected users can reference the Indicators of Compromise section of this document for guidance.

For CVE-2026-48273 and CVE-2026-75746, upgrade ColdFusion 2025 to Update 13 and ColdFusion 2023 to Update 24. Restrict access to ColdFusion administrative interfaces and tighten the set of accounts able to authenticate to affected instances, since both flaws require some existing level of access to exploit.

For CVE-2026-19232, upgrade Experience Manager to the fixed release for the applicable track (Cloud Service Release 2026.8.0, 6.5 LTS Service Pack 3, or 6.5 Service Pack 25) and review which accounts hold low-privilege access to the platform, since exploitation requires only a low-privileged account.

Information on all of the Adobe Products included in this security update is included on their Security Updates Page

Indicators of Compromise

Exploitation of CVE-2026-75650 has been traced to at least September 4th, 2026, days before Adobe's hotfix became available. Observed payloads include a Rust based Linux backdoor that beacons to an external server while disguising its process name (for example, as kworker or fc-cache) and a PHP web shell dropped into a writable web directory.

Defenders should review outbound connections from Commerce and Magento hosts that should only reach a payment gateway or content delivery network, inspect recently modified files under writable paths such as pub and generated, and look for unfamiliar processes spawned by php-fpm.

No indicators have been reported for CVE-2026-48273, CVE-2026-75746, or CVE-2026-19232.

Threat Intelligence

CVE-2026-75650, dubbed StyleSmuggler by researchers at Sansec who identified the active exploitation, is a template engine injection in Magento's core rendering system. An attacker sends a request that causes Magento's Payment Transaction Failed Reminder email template to render attacker-controlled PHP. The platform executes that code as it renders the template, without authentication or any user interaction. Because the vulnerable code path is core platform functionality rather than a third-party extension, every Adobe Commerce and Magento Open Source deployment on an affected version is reachable through a single request to an internet-facing storefront.

The remaining three vulnerabilities are unrelated in class and product. CVE-2026-48273 is an eval code injection flaw in ColdFusion that lets a low-privileged, authenticated attacker execute arbitrary code. CVE-2026-75746 is a SQL injection flaw in ColdFusion that requires an attacker to already hold high privileges. CVE-2026-19232 is an incorrect authorization flaw in Experience Manager that lets a low-privileged attacker execute arbitrary code and gain elevated control of another account's session. These three vulnerabilities were found by industry researchers and reported to Adobe. Adobe and public sources have not published further technical detail for these three at the time of writing, nor is any publicly available proof-of-concept exploit code available. However, they pose the highest threat of the non-exploited vulnerabilities announced in this security update, prompting their inclusion in this advisory.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-48273

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-75746

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-19232

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-75650

• 

  https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html

• 

  https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html

• 

  https://helpx.adobe.com/security/products/magento/apsb26-146.html

• 

  https://sansec.io/research/stylesmuggler-0day

• 

  https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog

• 

  https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146