Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways

netspi.com | vulnerability | CVE-2026-75650 | #rce | #template-injection | #magento | #adobe-commerce | #in-the-wild | #patch-now | #cve-2026-75650

Summary

CVE-2026-75650 (CVSS 10.0) lets unauthenticated attackers inject PHP through Magento's email template engine for RCE, with in-the-wild exploitation and Rust backdoors confirmed before the hotfix.
CVE
CVE-2026-75650
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways
The wp2shell chain pairs REST API route confusion (CVE-2026-63030) with WP_Query SQL injection (CVE-2026-60137) for unauthenticated full RCE on WordPress Core, now actively exploited in the wild.
vulnerability · netspi.com
CVE-2026-41940 cPanel & WHM Authentication Bypass Overview and Takeaways
CVE-2026-41940 (CVSS 9.8) is an authentication bypass in cPanel & WHM and WP Squared that injects values into server-side session files for root-level access, and was exploited before the patch.
advisory · aikido.dev
StyleSmuggler fix: patch the Magento and Adobe Commerce RCE
Aikido on StyleSmuggler: an unauthenticated RCE in all current Magento Open Source and Adobe Commerce versions, exploited since September 4 with no vendor patch yet, and its drop-in fixes.
vulnerability · netspi.com
Splunk Enterprise Unauthenticated Arbitrary File Operations/RCE (CVE-2026-20253): Overview and Takeaways
CVE-2026-20253 (CVSS 9.8) exposes an unauthenticated PostgreSQL sidecar endpoint in Splunk Enterprise 10.0.x/10.2.x, allowing file writes that chain to RCE via lo_export; a public PoC exists.
vulnerability · netspi.com
CVE-2026-9082 Drupal Core PostgreSQL SQL Injection Overview and Takeaways
CVE-2026-9082 (CVSS 9.8) lets unauthenticated attackers run arbitrary SQL against Drupal Core on PostgreSQL via crafted JSON:API queries, risking database compromise or RCE; upgrade immediately.
vulnerability · netspi.com
CVE-2026-0300 Palo Alto Networks PAN-OS Buffer Overflow Overview & Takeaways
CVE-2026-0300 is a pre-auth buffer overflow in the PAN-OS User-ID Authentication Portal giving unauthenticated root RCE on PA-Series and VM-Series firewalls, already exploited in the wild.
back