AIKIDO-2026-248927

magento/product-community-edition is vulnerable to Code Injection

Code InjectionCVE-2026-75650 Published Sep 6, 2026

Critical Risk

This Affects:

magento/product-community-edition

0.0.1 - 2.4.9

Are you affected? Scan for Free

TL;DR

magento/product-community-edition lets an unauthenticated requester inject PHP through styles properties on GraphQL requests, persist it via a failure report, then have it execute when Magento renders the Payment Transaction Failed Reminder email. Delivery of that email is not required because the payload runs during render. Successful exploitation leads to remote code execution and lets a backdoor be installed.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and GraphQL is reachable.

Background info

magento/product-community-edition is vulnerable to Code Injection in versions 0.0.1 - 2.4.9.

How to fix this

Apply the VULN-39341 hotfix for your release line and rotate your encryption keys and associated credentials (see https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146). Adobe ships APSB26-146 as Composer patch files rather than a version bump, and it is not included in the September 2026 Isolated patch, so the detected version of the magento/product-community-edition and/or the magento/magento2-base library does not change after the hotfix — ignore this finding manually in Aikido once the hotfix is applied.