Adobe patched StyleSmuggler. That is step 1 of 14.
CVE-2026-75650 is fixed, but Adobe’s own remediation list runs to fourteen steps and eight of them are credential rotations. The patch is the easy half.
Adobe shipped the StyleSmuggler fix on 7 September as APSB26-146. It is CVE-2026-75650, CVSS 10.0, and Adobe confirms it was exploited in the wild before the fix existed.
Apply it today. Then read the rest of this, because the patch is step 1 of 14.
It is a hotfix, not a release
There is no new 2.4.x version to upgrade to. Adobe ships this as a composer patch, VULN-39341-composer-patches.zip, from repo.magento.com. Everything from 2.4.4 to 2.4.9 is affected, Open Source and Commerce, plus B2B 1.3.3 through 1.5.3.
If you put a community patch in place last week, this replaces it. Take yours back out once Adobe’s is live, or you will be carrying two guards that do the same job and one of them will surprise you at the next upgrade.
The eight rotations nobody is going to do
Adobe’s own remediation list is fourteen steps. Four of them are maintenance mode and cron. One is the patch. The other eight are credential rotations:
the encryption key
every Admin panel user password
all REST, SOAP and GraphQL integration tokens, deactivated and regenerated
OAuth client secrets for connected third-party applications
payment gateway API credentials, at the provider
database credentials
SSH and deploy keys, plus any cron or system service account
API keys for shipping, tax and other integrated extensions
That is a real afternoon of work, and it touches things that break deployments when you get them wrong. Which is exactly why most shops will apply the patch, see a clean scan, and stop.
Why the rotations are the point
The bug gave an unauthenticated attacker code execution on your server. Anything that server could read, they could read. That includes the encryption key, and the encryption key is what protects everything else on the list.
Sansec, who found it, put it plainly: patching closes the hole but does not clean a store that was already hit. Stores were being attacked for three days before the hotfix existed. A patch applied today does nothing about a credential taken on Friday.
So the question is not whether you are patched. It is whether anyone had a shell on your server between 4 and 7 September, and if you cannot answer that with evidence, you rotate.
Do this in order
Scan first. If you patch before you look, you lose the easiest evidence.
grep -ril 'x_trace_' var/report/Then apply the hotfix, then rotate. Maintenance mode on and cron off for the middle of it, as Adobe sets out. And if the scan finds anything at all, stop and treat it as an incident rather than a patch job.
The short version
Adobe fixed it. That closes the door. It does not tell you who came through while it was open, and it does not take back the keys they picked up on the way.
Patch today. Rotate this week. Scan before both.