Topic
Security practices and incidents affecting online storefront platforms like Magento, WooCommerce, and BigCommerce, including breaches and patching.
CERT-In's September 16 advisory covers eleven Adobe product lines and fourteen vulnerability classes. Adobe says one of them, an unauthenticated remote code execution flaw in the commerce line, is already being exploited.
Reality
Adobe scored CVE-2026-75650 at 10.0 and shipped hotfix VULN-39341 three days after Sansec first saw it exploited. The first confirmed victim was running 2.4.6-p15, the newest release, and it had passed a security status check.
Reality
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
Reality
Adobe scored CVE-2026-75650 at 10.0 and hotfixed it outside the normal cycle after exploitation had already started. Imperva reports attempts against sites in 15 countries and backdoors dressed as system processes.
Reality
Sansec says the injected code executes while the server builds the notification, so nobody has to open anything and delivery can fail outright. Adobe's hotfix shuts the door and leaves the Rust backdoor and exposed credentials in place.
Reality
CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.
Reality
The breach notice rules out credit card details and confirms names, mobile numbers, order totals and postcodes. The second list is the one that makes a refund-scam call work.
Reality