Emergency WAF update: Adobe Commerce RCE protection (CVE-2026-75650)
Cloudflare WAF now blocks a critical zero-day RCE vulnerability (CVE-2026-75650) targeting Adobe Commerce and Magento storefronts. This emergency virtual patch provides immediate edge-level defense against unauthenticated attackers injecting PHP payloads through style properties, though urgent patching and credential rotation on origin applications are required.
This update provides immediate defense against a high-severity, actively exploited zero-day vulnerability targeting Adobe Commerce and Magento Open Source storefronts.
Key Findings
- Adobe Commerce and Magento RCE (CVE-2026-75650 / "StyleSmuggler"): Unauthenticated Remote Code Execution (RCE) vulnerability caused by improper neutralization of special elements in the platform's template engine. Unauthenticated attackers can inject arbitrary PHP payloads through style properties to execute system commands and deploy persistent malware.
Impact
This emergency rule provides immediate edge-level mitigation and virtual patching, origin applications must be urgently updated. We strongly recommend to apply the hotfix outlined in Adobe Security Bulletin APSB26-146 and immediately rotate all potentially exposed encryption keys, integration tokens, and system credentials, as patching alone does not remediate an existing compromise.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...440f5c55 | N/A | Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650 | N/A | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare One Client for Windows hotfix - trusted certificate chains
A new GA release for Windows Cloudflare One Client is available, addressing an issue with building trusted certificate chains.
Cloudflare One Client for macOS - Trusted Certificate Chain Fix
A new GA release of the macOS Cloudflare One Client is available. This hotfix addresses an issue with building trusted certificate chains.
Cloudflare One Client for Linux
A new GA release of Cloudflare One Client for Linux is now available. This hotfix addresses an issue with building trusted certificate chains.