Key takeaways

We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler ). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability.

The vulnerability carries a maximum CVSS score of 10.0 and requires no authentication or user interaction to exploit.

Attackers smuggle malicious PHP code into Magento’s template-processing chain via HTTP headers and parameters, later executing it during automated email rendering.

Based on our investigation, Akamai Adaptive Security Engine (ASE) CMD Injection protections already block the primary GraphQL header- and parameter-based exploitation vectors natively, requiring no new rule deployment.

We continue to validate detection coverage across all observed exploitation vectors for this vulnerability.

Affected customers should still apply Adobe’s official hotfix ( APSB26-146/VULN-39341 ) as soon as possible.

Vulnerability details

CVE-2026-75650…