Project
Adobe's paid edition of the Magento platform, sold both for self-hosting and as the managed Adobe Commerce on Cloud service.
Sansec disputes Adobe's 30-day patch window for CVE-2026-103849, a maximum-severity flaw in Magento and Adobe Commerce. It has seen no attacks yet but expects mass exploitation soon, citing StyleSmuggler's three days from hotfix to mass attacks.
Reality
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishersReality
Sansec reproduced an unauthenticated code-execution chain on clean 2.4.7, 2.4.8 and 2.4.9 installs, and the first victim it saw was already on Adobe's newest patch level for its release line.
Perspective Coverage
7 publishersReality
Magento Open Source stopped patching 2.4.6 on 11 August 2026, and about seven of the paid edition's twelve extra months fall after PHP 8.2 stops getting security fixes. The licence buys planning time.
Reality
CERT-In's September 16 advisory covers eleven Adobe product lines and fourteen vulnerability classes. Adobe says one of them, an unauthenticated remote code execution flaw in the commerce line, is already being exploited.
Reality
Adobe scored CVE-2026-75650 at 10.0 and shipped hotfix VULN-39341 three days after Sansec first saw it exploited. The first confirmed victim was running 2.4.6-p15, the newest release, and it had passed a security status check.
Reality
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
Reality
Adobe scored CVE-2026-75650 at 10.0 and hotfixed it outside the normal cycle after exploitation had already started. Imperva reports attempts against sites in 15 countries and backdoors dressed as system processes.
Reality
Sansec says the injected code executes while the server builds the notification, so nobody has to open anything and delivery can fail outright. Adobe's hotfix shuts the door and leaves the Rust backdoor and exposed credentials in place.
Reality
Adobe shipped the out-of-band hotfix on September 8. Sansec dates exploitation to September 4, and that four-day gap is why the advisory pairs the patch with a required encryption-key rotation.
Reality
CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.
Reality