Adobe Commerce/Magento Template Engine SSTI (CVE-2026-75650)

let templateSig = dynamic(["{{block", "{{trans", "{{config", "{{var", "{{template", "{{depend", "{%", "getData(", "objectManager", "filter/template"]);
AppServiceHTTPLogs
| where CsUriStem has_any ("/admin", "/rest/", "/graphql", "/newsletter", "/customer", "/checkout", "/sendfriend")
| where CsMethod in ("POST", "PUT", "GET")
| extend Payload = strcat(tostring(CsUriQuery), " ", tostring(CsReferer))
| where Payload has_any (templateSig)
| project TimeGenerated, CsHost, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, Payload
| sort by TimeGenerated desc

index=web (sourcetype="nginx:plus:access" OR sourcetype="apache:access" OR sourcetype="ms:aad:signin" OR sourcetype="stream:http")
(uri_path="*/admin*" OR uri_path="*/rest/*" OR uri_path="*/graphql*" OR uri_path="*/newsletter*" OR uri_path="*/sendfriend*")
| eval payload=uri_query." ".form_data." ".http_referer
| where match(payload, "(?i)(\{\{(block|trans|config|var|template|depend)|\{%|objectManager|filter/template|getData\()")
| stats count values(uri_path) as endpoints values(payload) as payloads by src_ip dest_host
| where count > 0
| sort - count

sequence by host.id with maxspan=2m
  [ network where url.path : ("*/admin*", "*/rest/*", "*/graphql*", "*/newsletter*", "*/sendfriend*") and
    (url.query : ("*{{block*", "*{{var*", "*{{config*", "*{%*", "*objectManager*", "*filter/template*")) ]
  [ process where event.type == "start" and process.parent.name in ("php-fpm", "php", "httpd", "nginx") and
    process.name in ("sh", "bash", "php", "curl", "wget", "python", "perl") ]

SELECT sourceip, destinationip, "URL", "HTTP Method", "Request Body" FROM events WHERE ("URL" ILIKE '%/admin%' OR "URL" ILIKE '%/rest/%' OR "URL" ILIKE '%/graphql%' OR "URL" ILIKE '%/newsletter%' OR "URL" ILIKE '%/sendfriend%') AND ("Request Body" IMATCHES '.*(\{\{(block|trans|config|var|template)|\{%|objectManager|filter/template).*' OR "URL" IMATCHES '.*(\{\{(block|var|config)|objectManager).*') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=web/magento ("/admin" OR "/rest/" OR "/graphql" OR "/newsletter" OR "/sendfriend")
| where (uri matches "*{{block*" or uri matches "*{{var*" or uri matches "*{{config*" or uri matches "*{%*" or uri matches "*objectManager*" or uri matches "*filter/template*")
| count by src_ip, host, uri
| sort by _count desc

rule magento_template_injection_cve_2026_75650 {
  meta:
    author = "argus"
    description = "Detects Adobe Commerce/Magento template engine SSTI (CVE-2026-75650)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.parsed_user_agent.raw, ".*") 
    ($e.target.url = /.*\/(admin|rest|graphql|newsletter|sendfriend).*/ nocase)
    ($e.target.url = /.*(\{\{(block|var|config|template)|\{%|objectManager|filter\/template).*/ nocase)
  condition:
    $e
}

#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(php-fpm|php|httpd|nginx)$/i
| ImageFileName=/(\/(sh|bash|dash|curl|wget|php|python[0-9.]*|perl)|cmd\.exe|powershell\.exe)$/i
| table([timestamp, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(timestamp, order=desc)