JA EN
shiichan

An unauthenticated RCE hits Adobe Commerce and Magento — Cloudflare rushes out an emergency fix for "StyleSmuggler"

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's me! I've got an urgent security story to share with you today, so let's get right into it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Cloudflare shipped an emergency WAF rule for immediate defense against a high-severity, actively exploited zero-day vulnerability targeting Adobe Commerce and Magento Open Source storefronts. The vulnerability is tracked as CVE-2026-75650, nicknamed "StyleSmuggler." It's caused by improper neutralization of special elements in the platform's template engine, letting unauthenticated attackers inject arbitrary PHP payloads through style properties to execute system commands and deploy persistent malware.

Why it matters

An unauthenticated remote code execution vulnerability is about as bad as it gets, since attackers don't even need to log in to get a foothold, which means the blast radius can grow very quickly. This one has also already been confirmed as actively exploited in the wild, which is why the response needed to move fast. Adobe Commerce and Magento power storefronts all over the world, so the number of potentially affected sites is significant.

What changes

Sites using Cloudflare's WAF now get edge-level blocking against this attack while their origin servers are still catching up on patching. That said, this is a stopgap: Cloudflare is explicit that this is virtual patching, and origin applications still need to be urgently updated.

Dive Deep

Here are the details of the newly added detection rule:

  • Ruleset: Cloudflare Managed Ruleset
  • Rule ID: 440f5c55
  • Description: Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650
  • Previous action: none (new detection)
  • New action: Block

Cloudflare strongly recommends three things:

  • Apply the hotfix outlined in Adobe Security Bulletin APSB26-146
  • Immediately rotate all potentially exposed encryption keys, integration tokens, and system credentials
  • Understand that patching alone does not remediate an existing compromise

That third point is the one that's easy to overlook but really matters. If you were already compromised before patching, a backdoor could still be sitting there, which is why rotating credentials needs to happen alongside the patch, not instead of it.

Wrap-up

  • CVE-2026-75650 ("StyleSmuggler"), an unauthenticated RCE in Adobe Commerce / Magento Open Source, is being actively exploited
  • It abuses the template engine to run arbitrary PHP via style properties
  • Cloudflare added an emergency Managed Ruleset rule, ID 440f5c55, set to Block
  • Applying Adobe's hotfix (APSB26-146) and promptly rotating credentials are both essential

If your team runs storefronts on Adobe Commerce or Magento, this is urgent news you'll want to check right now!

Related posts