{"id":"EM-20261104-K2HZ","url":"https://cyber.eventmonitor.net/incident/EM-20261104-K2HZ/cve-2026-75650-adobe-commerce-and-magento-improper-neutralization-of-special/","type":"cve","title":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","subtitle":"CVE-2026-75650","subject":"CVE-2026-75650","status":"Confirmed","severity":"medium","affected":["Adobe Commerce and Magento"],"headline":"15 hours from first report to confirmed exploitation.","born":"2026-11-04T04:51:55.000Z","firstSignal":"2026-11-03T14:09:27.567Z","lastSignal":"2026-11-04T04:51:55.000Z","updated":"2026-11-04T14:43:58.877Z","revision":2,"life":[{"status":"Born","at":"2026-11-04T04:51:55.000Z","why":"second independent source: C34 ProjectDiscovery nuclei-templates"},{"status":"Developing","at":"2026-11-04T04:51:55.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-04T04:51:55.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-11-03T14:09:27.567Z","what":"First signal: C56 AlienVault OTX pulses"},{"at":"2026-11-04T04:51:55.000Z","what":"Born: second source, C34 ProjectDiscovery nuclei-templates. Page EM-20261104-K2HZ created."},{"at":"2026-11-04T04:51:55.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"}],"stages":[{"name":"Disclosed","at":"2026-11-03T14:09:27.567Z","detail":"C56 first to name it"},{"name":"Scored","at":"2026-11-03T14:09:27.567Z","detail":"No CVSS yet · EPSS 3.9%"},{"name":"Exploited","at":"2026-11-04T04:51:55.000Z","detail":"C1 CISA KEV, fix by 2026-09-11"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-09-11, then 14 quiet days"}],"signals":[{"at":"2026-11-03T14:09:27.567Z","source":"C56","sourceName":"AlienVault OTX pulses","role":"Research & News","severity":2,"title":"StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores","text":"Between September 9 and September 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores across Western Europe, North America, and Asia-Pacific using CVE-2026-75650 (StyleSmuggler). The attack chain delivered a shell-script dropper, PSK Agent RAT, and PHP webshell through the /","url":"https://otx.alienvault.com/pulse/6ae9eb17c5d87b8a004ed8fb"},{"at":"2026-11-04T04:51:55.000Z","source":"C34","sourceName":"ProjectDiscovery nuclei-templates","role":"Research & News","severity":2,"title":"ProjectDiscovery nuclei-templates: Merge pull request #17655 from k0pak4/template-cve-2026-75650","text":"Merge pull request #17655 from k0pak4/template-cve-2026-75650 Add template for CVE-2026-75650 (StyleSmuggler)","url":"https://github.com/projectdiscovery/nuclei-templates/commit/43e772c3ab7682002af2a3e9e1b23dca06372442"}],"crowd":[],"reference":{"nvd":null,"kev":{"added":"2026-09-08","due":"2026-09-11","ransomware":"Unknown","vendor":"Adobe","product":"Commerce and Magento","name":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability"},"epss":{"epss":0.03949,"pct":0.90445,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}