{"schema":"vulnpedia.poc/1","cve":"CVE-2026-75650","kev":{"since":"2026-09-08","ransomware":false},"epss":{"score":0.03949,"percentile":0.9034},"cvss":{"version":"3.1","score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"test_commands":[{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-75650/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"generated":"2026-10-26T06:59:15.268Z","has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/42ed02be6fc5","executable":false,"sourceId":"42ed02be6fc5","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/42ed02be6fc5"}],"repositoryUrl":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b573eeb138c2","executable":false,"sourceId":"b573eeb138c2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/b573eeb138c2"}],"repositoryUrl":"https://github.com/fortbridge/stylesmuggler"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/fbadf382b020","executable":false,"sourceId":"fbadf382b020","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/fbadf382b020"}],"repositoryUrl":"https://github.com/abraxas/CVE-2026-75650"}],"poc_candidates":[{"url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.","modified":"2026-09-17T22:46:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-17T22:46:15Z","url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit"}],"tags":[]},{"url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.","modified":"2026-09-13T05:05:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-13T05:05:57Z","url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"}],"tags":[]},{"url":"https://github.com/disrex-group/stylesmuggler-adobe-patches","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.","modified":"2026-10-08T04:57:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-08T04:57:31Z","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches"}],"tags":[]},{"url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).","modified":"2026-09-08T10:50:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-08T10:50:41Z","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos"}],"tags":[]},{"url":"https://github.com/fortbridge/stylesmuggler","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"Private HTTP-only reproduction of CVE-2026-75650 StyleSmuggler","modified":"2026-10-20T16:49:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/fortbridge/stylesmuggler"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-20T16:49:39Z","url":"https://github.com/fortbridge/stylesmuggler"}],"tags":[]},{"url":"https://github.com/abraxas/CVE-2026-75650","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)","modified":"2026-10-07T01:06:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/abraxas/CVE-2026-75650"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-07T01:06:53Z","url":"https://github.com/abraxas/CVE-2026-75650"}],"tags":[]}],"detection_sources":[],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-75650%22&type=repositories","executable":false}]}