iTnews (Juha Saarinen, 10 September 2026, 4:37 am Perth) reports that the Australian Signals Directorate has sent a critical alert about CVE-2026-75650, rated CVSS 10.0, an improper neutralisation of special elements used in a template engine in Adobe Commerce and Magento Open Source that leads to unauthenticated remote code execution.

According to iTnews, ASD's ACSC said exploitation requires the /graphql endpoint to be exposed; the attack manipulates "styles" properties in a GraphQL request to slip PHP code past input sanitisation into a file the platform writes during normal operation, such as a payment failure report; and ACSC is aware of "a substantial number of potentially vulnerable instances" in Australia. iTnews says Sansec, which discovered and named the bug StyleSmuggler, said exploitation began on 4 September with the first confirmed compromise at 22:20 UTC, and published on 5 September before Adobe had issued a CVE or advisory; attackers had around three days before Adobe shipped a hotfix. ASD advises organisations to check for vulnerable versions, apply patches as soon as possible, and, if an MSP or IT provider manages the platform, confirm with them that it has been patched.

According to iTnews, Adobe's guidance advises merchants to rotate the Magento encryption key and the credentials it protected, and warns that patching would not remove implants attackers placed during the window before the hotfix.

CISA has added the bug to its Known Exploited Vulnerabilities catalog, iTnews reports. (source: iTnews)

Correction (01 Nov 2026): Sansec's research page and Adobe's bulletin did not load for this desk, so the card now rests on iTnews alone: details only they or BleepingComputer gave (hotfix timings and tested versions, implant names and a second attacker's tooling) were removed, and the card is now dated 10 September 2026, the date of iTnews' report, instead of 5 September. (source: iTnews)