StyleSmuggler
StyleSmuggler (CVE-2026-75650, APSB26-146) is the critical unauthenticated remote code execution flaw in the Magento template engine, scored CVSS 10 and actively exploited in the wild since before the disclosure.
If you have not patched yet, stop reading and install the two pinned patches right now: the APSB26-146 hotfix that closes the RCE itself, and the APSB26-138 security update that ships alongside it. You need both, on every supported 2.4.x release. Mage-OS users get the same fix plus extra hardening in the 3.5.0 emergency release, and there are community backports for unsupported versions down to 2.2.
Because the vulnerability was exploited before the fix existed, patching alone is not enough: assume compromise, run the detection scripts collected here and rotate your credentials afterwards.
The rest of this page collects the community stop-gap patches, hardening modules, detection and cleanup tooling, and root cause analysis that landed during the first days. We keep updating this page as new information comes in.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-146.htmlAnnounces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://m.academy/articles/magento-stylesmuggler-apsb26-146-security-patch/
Breaks down the APSB26-146/VULN-39341 hotfix: neutralizing payloads in error reports, restricting email template data types, adding admin preview ACL checks, and validating block types before instantiation. Clarifies why disabling GraphQL wasn't enough, covers the additional Bigbridge directive-signing patch, and shares practical steps for applying patches and cleaning compromised stores.
-
https://dor.ky/post/removing-adobe-fastly-rules-cve-2026-75650-admin-page-save
Fixes 403s on admin page/block saves by identifying and removing Fastly VCL snippets (accord-rce, accord_rce_1) via the CLI, with steps to clone, validate, and activate a clean version; also covers applying the real CVE-2026-75650 patch or scoping a storefront-only rule.
-
https://www.graycore.io/case-studies/CVE-2026-75650-style-smuggler
Covers how the Style Smuggler vulnerability (CVE-2026-75650) works, how to detect potential compromise, and practical remediation and hardening steps. Note: Content could not be fetched; details inferred from the URL.
-
https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix
Root-cause patch that restricts directive signing to explicitly deferred directives (like inlinecss), preventing signatures on unresolved directives exploited in the StyleSmuggler chain. Includes ready-to-apply patches for versions 2.4.5–2.4.9 and instructions for using composer-patches/cweagans.
-
Mage-OShttps://mage-os.org/releases/2026-09-08-mage-os-3-5-0-release/
Ports the StyleSmuggler (CVE-2026-75650, CVSS 10.0) hotfix with added hardening, includes September isolated patch APSB26-138, and fixes four bugs. Provides remediation guidance for possible compromises and notes ACL and template/block policy changes that may affect previews and custom directives.
-
https://dor.ky/post/adobe-september-2026-monthly-patch-mcloud-15053
Breaks down the September 2026 MCLOUD-15053 patch: fixes rollback ACL, export path traversal, GraphQL customer scope, Instant Purchase address ownership, PayPal Express quote binding, admin VAT XSS, URL escaping, plus B2B UI ACL and validator changes. Covers version-specific differences (2.4.4–2.4.9; B2B 1.3.3–1.5.3) and notes you also need APSB26-146.
-
https://scandiweb.com/blog/stylesmuggler-fix-for-older-magento-versions/
Offers 41 version-specific patches that backport the official StyleSmuggler (CVE-2026-75650) hotfix to unsupported 2.2.0–2.4.3-p3, with apply steps and guidance on mandatory credential rotation after patching.
-
https://github.com/yellowteak/APSB26-146-patches
Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.
-
https://gist.github.com/pingiun/00cfbfdc3cf517807eb3b6bc24c7f295
Patch implementing explicit directive deferral and signing in the template filter to block unresolvable directives from being treated as deferred and executed by parent templates. Includes diffs for Framework Template and Email Template Filter, adapted for Composer installs and intended to be applied alongside APSB26-146.
-
https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis
Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.
Mage-OS