Hi Community,
Our Threat Research team shared the following update:
A new vulnerability was discovered in Magento and Adobe Commerce, tracked as CVE-2026-75650 (StyleSmuggler). The vulnerability is unauthenticated and poses a risk for enterprises using affected Magento or Adobe Commerce deployments.
Vulnerability Description:
CVE-2026-75650: Magento and Adobe Commerce contain an unauthenticated remote code execution vulnerability, dubbed StyleSmuggler, involving unsafe processing of attacker-controlled style parameters. An unauthenticated remote attacker can submit specially crafted parameters to the GraphQL endpoint, potentially causing server-side template processing and execution of attacker-controlled directives.
The vulnerability can be triggered through HTTP requests without requiring authentication, making publicly exposed Magento/Adobe Commerce installations potentially vulnerable.
Cloud WAF customers are already protected against this vulnerability out of the box.
On-prem WAF customers who enabled automatic THR emergency-feed updates also received a new signature to block it out of the box.
On-prem WAF customers without the THR Emergency Feed update who use Magento and Adobe Commerce should create a new signature to mitigate this vulnerability.
Here's the guide on how to create this signature:
Signature 1:
Signature Name:
CVE-2026-75650: Magento and Adobe Commerce - StyleSmuggler Unauthenticated RCE
Signature Pattern:
part="/graphql", part="styles[", rgxp="(^|&)styles\\[[^=]{0,50}="
Protocols:
Search Signature in:
Signature 2:
Signature Name:
CVE-2026-75650: Magento and Adobe Commerce - StyleSmuggler Unauthenticated RCE (2)
Signature Pattern:
part="{{block", rgxp="(^|&)[^=]{0,50}(generatorClass|with_resolved)[^=]{0,50}="
Protocols:
Search Signature in:
#On-PremisesWAF(formerlySecuresphere)
#AllImperva#CloudWAF(formerlyIncapsula)