Adobe Commerce & Magento - RCE WAF Rule by crowdsecurity | CrowdSec Hub

Adobe Commerce & Magento - RCE

WAF rulehttp:exploitcve.CVE-2026-75650MITRE T1190cwe.CWE-1336

By: crowdsecurity
Version: 0.1
Name: crowdsecurity/vpatch-CVE-2026-75650

Magento "StyleSmuggler" RCE (CVE-2026-75650)

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Virtual Patching.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2026-75650

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/vpatch-CVE-2026-75650.yaml· 35 linesGitHub

1name: crowdsecurity/vpatch-CVE-2026-75650
2description:  Magento "StyleSmuggler" RCE (CVE-2026-75650)
3
4rules:1
5  - or:
6    - zones:2
7        - URI_FULL
8      transform:3
9        - lowercase
10        - urldecode
11      match:4
12        type: regex
13        value: '<\?(php|=)|\\u003c\?'
14    - zones:2
15        - HEADERS
16      variables:1
17        - store
18      transform:3
19        - lowercase
20        - urldecode
21      match:4
22        type: regex
23        value: '<\?|\\u003c\?'
24
25labels:5
26  type: exploit
27  service: http
28  confidence: 3
29  spoofable: 0
30  behavior: 'http:exploit'
31  label: 'Adobe Commerce & Magento - RCE'
32  classification:
33    - cve.CVE-2026-75650
34    - attack.T1190
35    - cwe.CWE-1336

Adobe Commerce & Magento - RCE

Installation

Configuration

Installed on

Know where it runs