Attackers have been planting web shells on Magento stores since September 4
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
The Watch · Security desk
What happened
- CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation: one in Adobe Commerce and Magento, two in Windows, and one in N-able N-central.
- Sansec says CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw it calls StyleSmuggler, has been exploited since September 4 to deploy web shells and backdoors on online stores.
- Sansec puts current Magento Open Source releases in scope, naming 2.4.7, 2.4.8 and 2.4.9 among the affected versions.
- The federal due date for the Magento and N-able flaws is September 11, 2026, eleven days ahead of the September 22 date CISA set for the two Windows privilege-escalation bugs.
Why it matters
- Who's exposed exposure Any storefront that was reachable during the exploitation window has to be treated as possibly already carrying an implant, because the update shuts the door behind whatever came through it.
- Who has to decide decision For federal agencies the ticket no longer closes on patch evidence alone; BOD 26-04 makes the question of whether the box was already compromised part of the required work.
- What doesn't add up contradiction The two sources invoke different binding directives, and the difference changes what is owed: a fix by the due date under 22-01, versus risk-ranked remediation plus a compromise check under 26-04.
- What it limits constraint Merchants outside the federal branch inherit the same exploitation with no deadline attached, so the scheduling call sits entirely with whoever owns the storefront.
Next story · Security · Sep 21
CISA gives agencies one business day to patch three exploited Linux kernel flawsConfirmed5 publishers
The chain has two stages and they need not be adjacent in time. Sansec describes a first stage that creates or poisons a record, dropping PHP into Magento's templating path, and a second stage in which a routine email-rendering process evaluates that template and the code runs [8]. The first stage needs no credentials [2]. Because execution happens inside the platform's own mail rendering, the timestamp on the compromise belongs to the store's email job rather than to the attacker's request [17], which is where log review tends to go wrong on this class of bug.
Seven days separate the start of known exploitation from the federal due date for this CVE [14]. Any storefront that was reachable across that window and gets patched afterwards still owes an answer on what was left behind: the update removes the injection path, and a web shell dropped before the update is unaffected by it [12].
Neither source names a fixed Magento release or a mitigation for CVE-2026-75650, while Security Affairs does record N-able shipping an emergency hotfix for its own CVSS 10.0 pre-auth code injection flaw, CVE-2026-86218 [13][5]. Sansec's affected list includes 2.4.9 [7]. So the remediation instruction for merchants is, on the published evidence, incomplete.
The two sources also point at different directives. CISA's alert grounds the requirement in BOD 26-04, which tells FCEB agencies to prioritize KEV CVEs on publicly exposed assets that grant total control after exploitation, defer the lower-risk ones, and check whether the system was compromised before the patch went on [10]. Security Affairs frames the same additions under BOD 22-01 and its due dates [18]. For a bug whose observed payload is a web shell [6], the 26-04 clause that matters is the pre-patch compromise check.
Eleven days sit between the two due dates in this batch [15], and that gap is the prioritization written as arithmetic: two unauthenticated remote code execution flaws at CVSS 10.0 on internet-reachable software go first [16], the two local privilege escalations at 7.8 go second [3][4]. One of those is the first Windows Update Stack vulnerability Microsoft has confirmed as exploited [3]. It is a second-half-of-the-intrusion problem, and CISA has priced it that way.
For a store on 2.4.7, 2.4.8 or 2.4.9 [7], the useful search is for template records containing PHP [8] and for files the web user wrote on or after September 4 [6].
What to watch
- Whether Adobe or Sansec publishes a patched version number or mitigation for 2.4.7, 2.4.8 and 2.4.9, which the sources currently do not name.
- Whether CISA issues supplemental guidance on how FCEB agencies satisfy the BOD 26-04 pre-patch compromise check for a web shell payload.
- Whether the first confirmed exploitation of a Windows Update Stack flaw, CVE-2026-81963, gets attributed to a named actor.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption68
- Hype gap+5
- Incentives32
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-75650 (Adobe Commerce and Magento improper neutralization of special elements in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow) and CVE-2026-86218 (N-able N-central static code injection).
- [2]
CVE-2026-75650 carries a CVSS score of 10.0 and lets unauthenticated attackers run code on vulnerable Adobe Commerce and Magento online stores.
- [3]
CVE-2026-81963 (CVSS 7.8) is a Microsoft Windows Update Stack link-following flaw allowing a local attacker to escalate privileges; Microsoft confirmed active exploitation, and it is the first Update Stack vulnerability Microsoft has confirmed attackers are actively exploiting.
- [4]
CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in the Windows Advanced Local Procedure Call component allowing a local attacker to elevate privileges to SYSTEM; Microsoft confirmed active exploitation.
- [5]
CVE-2026-86218 (CVSS 10.0) is an N-able N-central static code injection flaw allowing a pre-authenticated remote attacker to execute arbitrary code; it has been exploited in the wild and N-able released an emergency hotfix.
- [6]
Sansec researchers say the flaw, tracked as StyleSmuggler, has been actively exploited in the wild since September 4, with attackers reportedly using it to deploy web shells and backdoors.
- [7]
Sansec researchers say the flaw affects current Magento Open Source releases, including 2.4.7, 2.4.8 and 2.4.9.
- [8]
StyleSmuggler works by placing PHP code into Magento's templating path and later causing the platform to evaluate it; the first stage creates or poisons a record, while the second stage turns a routine email-rendering process into remote code execution.
- [9]
CISA orders federal agencies to fix the Windows flaws by September 22, while the remaining vulnerabilities must be addressed by September 11, 2026.
- [10]
BOD 26-04 requires FCEB agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV Catalog CVEs on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities, and establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
- [11]
BOD 26-04 applies only to FCEB agencies; CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
- [12]
Because the observed payload is a web shell or backdoor deployed from September 4 onward, applying the update closes the injection path but does not remove access already established, so remediation and a pre-patch compromise check are separate pieces of work.
- [13]
Neither source states a fixed release or mitigation for CVE-2026-75650, although Security Affairs records an emergency hotfix for the N-able flaw CVE-2026-86218.
- [14]
Known exploitation of CVE-2026-75650 began seven days before the September 11, 2026 federal remediation deadline that covers it.
- [15]
The two due dates in this KEV batch are eleven days apart.
- [16]
Two of the four newly catalogued vulnerabilities are CVSS 10.0 pre-authentication remote code execution flaws in internet-reachable software (Magento/Adobe Commerce and N-able N-central); the other two are local privilege escalations scored 7.8.
- [17]
Since the second stage executes when the platform renders email, the timestamp of code execution corresponds to the store's own mail process rather than to the attacker's inbound request.
- [18]
Security Affairs frames the remediation obligation for these four additions under Binding Operational Directive 22-01, which requires FCEB agencies to address catalogued vulnerabilities by the due date.
Sources
2 independent publishers whose own reporting we read for this story.
- cisa.govCISA Adds Four Known Exploited Vulnerabilities to Catalog
1 article · September 8, 2026
- securityaffairs.comU.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog
1 article · September 10, 2026
Topics and entities
Topics
- E-commerce Platform Security
- Privilege Escalation
- Web Shells
- Known Exploited Vulnerabilities catalog
- Federal Vulnerability Directives