On September 7, 2026, Adobe released an official fix for the StyleSmuggler vulnerability (CVE-2026-75650) in Security Bulletin APSB26-146. If you run a store on Magento or Adobe Commerce, this is the update you’ve been waiting for since this became public, and it should be a priority.
The patch covers supported versions from 2.4.6 upward. If your store runs 2.4.5 or older, no official fix is coming, and doing nothing leaves you exposed to an attack that is actively being exploited. Every version below that gets nothing official, even though those stores are just as vulnerable to an attack that is actively being exploited. So we rebuilt the fix ourselves for 41 older versions, from Magento 2.2.0 through 2.4.3-p3, and you can download it below.
Here’s what Adobe released, who’s covered, and what to do this week depending on the version you’re on.
A quick recap of what StyleSmuggler is
StyleSmuggler is a critical vulnerability in the Magento and Adobe Commerce core, disclosed by security firm Sansec on September 5. It lets an unauthenticated attacker, with no login and no user interaction, run code on a store’s server, reach its data, and plant a persistent backdoor.
It affects every current version, and being fully patched beforehand was no protection: the attack was reproduced on clean 2.4.7, 2.4.8, and 2.4.9 installs, and the first confirmed case was on 2.4.6 with Adobe’s July and August updates already in place.
What Adobe released
Adobe has released an official fix for the StyleSmuggler vulnerability (CVE-2026-75650) in Security Bulletin APSB26-146.
For Adobe Commerce (including B2B and Cloud), the hotfix covers 2.4.4 through 2.4.9. If you’re on a supported Adobe Commerce version, there is a patch for you.
For Magento Open Source, the hotfix covers 2.4.6 through 2.4.9 only. There is no official fix for Magento Open Source below 2.4.6.
Does Adobe’s hotfix cover your version?
| Edition | Adobe’s hotfix covers | No patch from Adobe |
|---|---|---|
| Adobe Commerce | 2.4.4 to 2.4.9 | below 2.4.4 |
| Adobe Commerce B2B | 1.3.3 to 1.5.3 | below 1.3.3 |
| Magento Open Source | 2.4.6 to 2.4.9 | 2.4.5 and below |
If you run Magento Open Source on 2.4.5 or earlier, you are in the most exposed position of anyone affected. We’re preparing a dedicated fix for these older Open Source versions.
If you’re in the left column, apply Adobe’s official VULN-39341 hotfix now, then rotate your credentials (see below).
On an older version Adobe left out?
If you’re in the right-hand column above, Adobe Commerce below 2.4.4 or Magento Open Source 2.4.5 and earlier, no official hotfix is coming. We rebuilt Adobe’s fix for every Magento version from 2.2.0 to 2.4.3-p3, 41 versions in total, so those stores aren’t left exposed.
Before you patch: check for a break-in
If your store has been online since September 4, look before you patch. A patch closes the hole, but it does not remove an attacker who is already inside. Known indicators of compromise:
- Unexpected “Payment Transaction Failed Reminder” emails
- Unfamiliar background processes on the server
- New scheduled tasks
- Unknown files in the report and temp folders
If you find any of these, prioritize a full compromise investigation alongside patching.
How to apply the Adobe patch
- Start on staging. Take a snapshot you can roll back to.
- Apply the patch for your exact version. From your Magento root:
patch -p1 < VULN-39341_<version>.patch - Test the shopping journey. Cart, checkout, payment, and transactional email. Then repeat on production.
- Rotate the encryption key and all credentials.
Patching is only half; you must rotate credentials
Adobe is explicit that applying VULN-39341 is not enough on its own. Because the vulnerability could expose your store’s encryption key, and that key protects integration tokens, payment gateway credentials, and system automation tokens, you must rotate not just the encryption key but every credential
In practice, after applying the hotfix, that means rotating:
- Admin panel user passwords
- REST, SOAP, and GraphQL integration tokens (deactivate and regenerate)
- OAuth client secrets for connected apps
- Payment gateway API credentials, at the provider (Stripe, Braintree, Adyen, PayPal, and so on)
- Database credentials
- SSH and deploy keys, and any cron or system service-account credentials
- API keys for shipping, tax, and other third-party extensions.
Rather have scandiweb do it for you?
We check your store for a break-in, apply the patch, test the shopping journey, and rotate the keys. For the full account of how we protected client stores in the days before Adobe’s fix existed, see Magento and Adobe Commerce Under Attack: scandiweb’s Rapid Response to StyleSmuggler.
Not a scandiweb’s client yet? Start with a free security check that needs no access to your store, or talk to our Magento team.
