When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650
当支付失败邮件成为漏洞利用工具：深入解析 CVE-2026-75650 的 Magento 模板渲染链
CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler, documented exploitation starting 4 September 2026. Adobe published the emergency hotfix VULN-39341 on 7 September 2026 under advisory APSB26-146. The relevant window is those three days. A store that was compromised before the hotfix did not become safe by applying it.
CVE-2026-75650 是 Adobe Commerce 和 Magento Open Source 中的一个未经身份验证的远程代码执行漏洞，该漏洞于 2026 年 9 月 8 日被列入 CISA 的“已知被利用漏洞”（KEV）目录。荷兰电子商务安全公司 Sansec 将此次攻击活动命名为“StyleSmuggler”，并记录到该漏洞从 2026 年 9 月 4 日开始被利用。Adobe 于 2026 年 9 月 7 日发布了紧急热补丁 VULN-39341（公告编号 APSB26-146）。关键的风险窗口期正是这三天。如果商店在补丁发布前已被入侵，仅应用补丁并不能使其恢复安全。
Technical context
技术背景
The flaw is classified as CWE-1336, improper neutralization of special elements used in a template engine. The affected version range covers Adobe Commerce 2.4.4 through 2.4.9 (through the 2026-aug builds), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Stores that applied the August 2026 monthly patch remained vulnerable, which is why the hotfix was distributed separately. Adobe assigned a CVSS 10.0 to the flaw. The attack requires no authentication and no user interaction.
该漏洞被归类为 CWE-1336，即对模板引擎中使用的特殊元素处理不当。受影响的版本范围包括 Adobe Commerce 2.4.4 至 2.4.9（截至 2026 年 8 月构建版本）、Adobe Commerce B2B 1.3.3 至 1.5.3，以及 Magento Open Source 2.4.6 至 2.4.9。即使是应用了 2026 年 8 月月度补丁的商店仍然存在漏洞，这就是为什么需要单独发布热补丁的原因。Adobe 为该漏洞分配了 10.0 的 CVSS 评分。该攻击无需身份验证，也无需任何用户交互。
How the attack chain works
攻击链的工作原理
Public analyses from Sansec and the Fortbridge proof-of-concept repository describe the sequence consistently: The attacker places crafted, poisoned data where Magento generates its own records - error reports and payment transaction data. The attacker triggers the standard “Payment Transaction Failed Reminder” email. Rendering that template is the exploit moment: the template engine processes the poisoned data with inadequate neutralization. Through an object-injection chain into Magento’s dependency-injection container, the processed data is included and executed as PHP with web-server privileges.
来自 Sansec 的公开分析和 Fortbridge 的概念验证（PoC）存储库一致描述了攻击序列：攻击者将精心构造的恶意数据放置在 Magento 生成记录的位置（如错误报告和支付交易数据中）。随后，攻击者触发标准的“支付交易失败提醒”邮件。渲染该模板即是漏洞利用的关键时刻：模板引擎在处理这些恶意数据时未能进行充分的过滤。通过进入 Magento 依赖注入容器的对象注入链，处理后的数据被包含并以 Web 服务器权限作为 PHP 代码执行。
Observed payloads include a Rust backdoor disguised as kernel-thread and system processes such as [kworker/u:8:0], fc-cache, or chronyd, communicating over UDP 123 disguised as NTP traffic, and small PHP web shells written into media directories. One detail matters for detection: a burst of “payment failed” notification emails without matching failed orders is a reasonable early indicator, because the exploit ride on the same rendering path.
观察到的载荷包括伪装成内核线程和系统进程（如 [kworker/u:8:0]、fc-cache 或 chronyd）的 Rust 后门，它们通过伪装成 NTP 流量的 UDP 123 端口进行通信，以及写入媒体目录的小型 PHP Web Shell。一个值得注意的检测细节是：如果出现大量“支付失败”通知邮件，但系统中却没有对应的失败订单，这通常是一个合理的早期预警信号，因为该漏洞利用正是通过相同的渲染路径进行的。
Defensive implications
防御建议
Patching closes the flaw but does not evict an intruder. The post-compromise checklist from the primary sources is concrete: Inspect pub/media for PHP files that do not belong there. Check running processes for names imitating kernel threads and font or time services, and watch for egress to UDP 123. Rotate credentials in a specific order: encryption keys first, because they protect everything else, then admin passwords, API tokens (REST, GraphQL, SOAP), payment gateway credentials, database accounts, and SSH keys. Run a targeted scanner such as Sansec’s eComscan, which identifies the Rust backdoor and secondary web shells. For EOL versions such as 2.4.0-2.4.3, only community backports exist; they are unverified by Adobe and require staging validation before production use.
打补丁可以修复漏洞，但无法清除已入侵的攻击者。主要来源提供的入侵后检查清单非常具体：检查 pub/media 目录中是否存在不应存在的 PHP 文件。检查运行中的进程，查看是否有模仿内核线程、字体服务或时间服务的名称，并监控是否有发往 UDP 123 的出站流量。按特定顺序轮换凭据：首先是加密密钥（因为它们保护所有其他内容），然后是管理员密码、API 令牌（REST、GraphQL、SOAP）、支付网关凭据、数据库账户和 SSH 密钥。运行如 Sansec 的 eComscan 等针对性扫描器，以识别 Rust 后门和二级 Web Shell。对于 2.4.0-2.4.3 等已停止支持（EOL）的版本，仅存在社区提供的反向移植补丁；这些补丁未经 Adobe 验证，在生产环境使用前必须进行阶段性验证。
The StyleSmuggler case is a reminder that transactional email rendering is code execution in waiting. Treat “the store sends email” as an attack surface, not plumbing.
StyleSmuggler 事件提醒我们，事务性邮件的渲染过程实际上是潜在的代码执行点。请将“商店发送邮件”视为一个攻击面，而不是简单的后台基础设施。