Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
2026-09-16T08:52:10Z•e3cdb8c3036a010ca7a0f322e85c28276129395b41156db25911bac9529f4cf8
CVE-2026-75650Adobe CommerceMagentoMagento Open SourceMicrosoft Patch TuesdayOracle CSPUStyleSmugglerVULN-39341active exploitatione-commercepatch managementremote code executionunauthenticatedweb applicationszero-day
What happened
Tenable reports a critical, actively exploited unauthenticated remote code execution zero-day, CVE-2026-75650 (StyleSmuggler), affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Exploitation began September 4, 2026, before Adobe released hotfix VULN-39341 on September 7. The feed also summarizes broad September 2026 Oracle and Microsoft security updates, including 672 and 964 CVEs respectively, but the most urgent actionable item is patching affected Magento and Adobe Commerce deployments.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- tenable_blog
- Record identifier
- e3cdb8c3036a010ca7a0f322e85c28276129395b41156db25911bac9529f4cf8
- Enrichment time
- 2026-09-16T08:52:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.