{"schema":"vulnpedia.research/1","cve":"CVE-2026-75650","references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html","tags":["vendor-advisory","Patch","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"adobe","modified":"2026-09-07T20:17:16.761Z","origins":[{"source":"mitre","sourceId":"adobe","modified":"2026-09-07T20:17:16.761Z","url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html"},{"source":"nvd","sourceId":"CVE-2026-75650","modified":"2026-09-09T05:18:07.237","url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html"},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-09T04:25:47.708Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-09T04:25:47.708Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650"},{"source":"nvd","sourceId":"CVE-2026-75650","modified":"2026-09-09T05:18:07.237","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650"}]},{"source":"euvd","sourceId":"EUVD-2026-72530","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72530","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-72530","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72530"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://sansec.io/research/stylesmuggler-0day","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-72530","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-72530"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.imperva.com/blog/imperva-customers-protected-against-stylesmuggler-cve-2026-75650-in-adobe-commerce-and-magento-open-source/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://www.imperva.com/blog/imperva-customers-protected-against-stylesmuggler-cve-2026-75650-in-adobe-commerce-and-magento-open-source/"}]},{"url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento"}]},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2026-75650-stylesmuggler-rce-adobe-commerce-magento","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://www.crowdsec.net/vulntracking-report/cve-2026-75650-stylesmuggler-rce-adobe-commerce-magento"}]},{"url":"https://vulncheck.com/xdb/42ed02be6fc5","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/42ed02be6fc5"}]},{"url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"}]},{"url":"https://vulncheck.com/xdb/b573eeb138c2","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/b573eeb138c2"}]},{"url":"https://github.com/fortbridge/stylesmuggler","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","url":"https://github.com/fortbridge/stylesmuggler"}]},{"url":"https://vulncheck.com/xdb/fbadf382b020","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/fbadf382b020"}]},{"url":"https://github.com/abraxas/CVE-2026-75650","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","url":"https://github.com/abraxas/CVE-2026-75650"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.","modified":"2026-09-17T22:46:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-17T22:46:15Z","url":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit"}],"tags":[]},{"url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.","modified":"2026-09-13T05:05:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-13T05:05:57Z","url":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab"}],"tags":[]},{"url":"https://github.com/disrex-group/stylesmuggler-adobe-patches","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.","modified":"2026-10-08T04:57:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-08T04:57:31Z","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches"}],"tags":[]},{"url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).","modified":"2026-09-08T10:50:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-09-08T10:50:41Z","url":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos"}],"tags":[]},{"url":"https://github.com/fortbridge/stylesmuggler","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"Private HTTP-only reproduction of CVE-2026-75650 StyleSmuggler","modified":"2026-10-20T16:49:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/fortbridge/stylesmuggler"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-20T16:49:39Z","url":"https://github.com/fortbridge/stylesmuggler"}],"tags":[]},{"url":"https://github.com/abraxas/CVE-2026-75650","source":"poc-in-github","sourceId":"CVE-2026-75650","description":"CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)","modified":"2026-10-07T01:06:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-75650","url":"https://github.com/abraxas/CVE-2026-75650"},{"source":"poc-in-github","sourceId":"CVE-2026-75650","modified":"2026-10-07T01:06:53Z","url":"https://github.com/abraxas/CVE-2026-75650"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"42ed02be6fc5","url":"https://vulncheck.com/xdb/42ed02be6fc5","cve":"CVE-2026-75650","dateAdded":"2026-09-08T21:54:44Z","modified":"2026-09-07T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab","observations":[{"dateAdded":"2026-09-08T21:54:44Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"42ed02be6fc5","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/42ed02be6fc5"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"b573eeb138c2","url":"https://vulncheck.com/xdb/b573eeb138c2","cve":"CVE-2026-75650","dateAdded":"2026-09-12T14:27:02Z","modified":"2026-09-07T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/fortbridge/stylesmuggler","observations":[{"dateAdded":"2026-09-12T14:27:02Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"b573eeb138c2","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/b573eeb138c2"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"fbadf382b020","url":"https://vulncheck.com/xdb/fbadf382b020","cve":"CVE-2026-75650","dateAdded":"2026-09-28T09:44:47Z","modified":"2026-09-07T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/abraxas/CVE-2026-75650","observations":[{"dateAdded":"2026-09-28T09:44:47Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"fbadf382b020","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/xdb/fbadf382b020"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-09-07T00:00:00Z","modified":"2026-09-07T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Adobe","product":"Commerce and Magento","dueDate":"2026-09-11T00:00:00Z","cisaDateAdded":"2026-09-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","modified":"2026-09-07T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","catalog":"VulnCheck KEV","kind":"report","url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html","dateAdded":"2026-09-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html"},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","catalog":"VulnCheck KEV","kind":"report","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-72530","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-72530"},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","catalog":"VulnCheck KEV","kind":"report","url":"https://www.imperva.com/blog/imperva-customers-protected-against-stylesmuggler-cve-2026-75650-in-adobe-commerce-and-magento-open-source/","dateAdded":"2026-09-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://www.imperva.com/blog/imperva-customers-protected-against-stylesmuggler-cve-2026-75650-in-adobe-commerce-and-magento-open-source/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","catalog":"VulnCheck KEV","kind":"report","url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento","dateAdded":"2026-09-14T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento"},{"source":"vulncheck-kev","sourceId":"CVE-2026-75650","url":"https://www.crowdsec.net/vulntracking-report/cve-2026-75650-stylesmuggler-rce-adobe-commerce-magento"}]}]}