vulnerability
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-146.htmlAnnounces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://www.graycore.io/case-studies/CVE-2026-75650-style-smuggler
Covers how the Style Smuggler vulnerability (CVE-2026-75650) works, how to detect potential compromise, and practical remediation and hardening steps. Note: Content could not be fetched; details inferred from the URL.
-
Mage-OShttps://mage-os.org/releases/2026-09-08-mage-os-3-5-0-release/
Ports the StyleSmuggler (CVE-2026-75650, CVSS 10.0) hotfix with added hardening, includes September isolated patch APSB26-138, and fixes four bugs. Provides remediation guidance for possible compromises and notes ACL and template/block policy changes that may affect previews and custom directives.
-
https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis
Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://github.com/muench-dev/StyleSmuggler
Three bash scripts to scan for IoCs and guide cleanup on servers, apply community mitigations via Composer patches and a hardening module, and remotely check GraphQL exposure. Includes DDEV/Warden support, cloud-friendly usage, and step-by-step confirmations.
110 -
https://mageinfo.online/
Instantly checks if your shop is up to date, flags known CVEs, and reviews server configuration, including full DNS analysis.
-
https://github.com/sansecio/magevulndb
Magento is an attractive target for payment skimmers and the number of attacks has increased steadily since 2015. In 2018, attackers shifted from Magento core exploits (eg, Shoplift, brute force attacks on admin passwords) to 3rd party software components. This poses a practical problem: there is no central place where one can (programmatically) find out whether a particular module version has known security issues. This repository solves that!
37221 -
https://github.com/markshust/magento-polyshell-patch
Mitigates the PolyShell vulnerability (APSB25-94) — an unrestricted file upload in the Magento REST API that allows attackers to upload executable files via cart item custom option file uploads.
1364 -
https://www.sdj.pw/posts/magento2-session-reaper-cve-2025-54236/
How to guide on checking if your Magento 2 store is safe from the Session Reaper (CVE-2025-54236) exploit. And guidance on how to patch and secure your site if it is not.
-
https://maxchadwick.xyz/blog/shutting-down-file-upload-controllers-for-session-reaper-is-futile
Since Searchlight Cyber published a technical write up and proof-of-concept for the SessionReaper vulnerability, attackers have been mass scanning Magento / Adobe Commerce stores for vulnerable targets. The first phase of the attack involves uploading a payload containing malicious session data to the server.
Mage-OS