CVE-2026-75650 IBM QRadar · QRadar

Detect Adobe Commerce/Magento Template Engine SSTI (CVE-2026-75650) in IBM QRadar

Detects exploitation of CVE-2026-75650, a KEV-listed server-side template injection (CWE-1336) in Adobe Commerce and Magento arising from improper neutralization of special elements used in the template engine. Attackers inject template directives (e.g. {{...}}, {%...%}) into fields processed by the storefront/admin template engine to achieve code execution, PHP object instantiation, or filesystem/config disclosure. Detection focuses on template directive syntax in HTTP request bodies/parameters to Magento endpoints, anomalous PHP process spawning from the web server, and unexpected writes to Magento var/ and pub/media directories.

MITRE ATT&CK

Tactic
Initial Access Execution

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, "URL", "HTTP Method", "Request Body" FROM events WHERE ("URL" ILIKE '%/admin%' OR "URL" ILIKE '%/rest/%' OR "URL" ILIKE '%/graphql%' OR "URL" ILIKE '%/newsletter%' OR "URL" ILIKE '%/sendfriend%') AND ("Request Body" IMATCHES '.*(\{\{(block|trans|config|var|template)|\{%|objectManager|filter/template).*' OR "URL" IMATCHES '.*(\{\{(block|var|config)|objectManager).*') ORDER BY startTime DESC LAST 24 HOURS
critical severity medium confidence

Returns Magento HTTP events containing template-engine directive syntax consistent with CVE-2026-75650 SSTI exploitation.

Data Sources

Web server DSMWAF DSM

Required Tables

events

False Positives & Tuning

  • Admin CMS/email template edits containing directive syntax
  • Penetration test and scanner traffic
  • Stored newsletter template content re-submitted through the app

Other platforms for CVE-2026-75650

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Magento template directive injection via newsletter field

    Expected signal: Web access log entry to /newsletter/subscriber/new/ containing {{config ...}} directive syntax.

  2. Test 2Template directive with objectManager reference

    Expected signal: Web access log entry to /sendfriend/ with block/objectManager directive in the query string.

  3. Test 3Simulated SSTI-to-shell process spawn

    Expected signal: Process start event: php/php-fpm parent spawning bash and id under the www-data account.

Last updated: 2026-09-09 Research depth: standard
References (5)

Response Playbook

Triage

  1. Extract the full request URI, body and referer from the alert and confirm the payload contains Magento template directives ({{block}}, {{config}}, {{var}}, {%...%}) or objectManager references rather than legitimately stored CMS template markup.
  2. Identify the target endpoint (admin, /rest/, /graphql, newsletter, sendfriend) and the source IP; check whether the source IP is an authenticated admin session or anonymous storefront traffic.
  3. Determine the HTTP response status and size — a 200 with a large/reflective body or a 500 error following the directive suggests the template engine attempted to evaluate the injected content.
  4. Correlate the request timestamp with any child process, file-write or outbound connection events on the web/app host within a 2-minute window.

Containment

  1. Block the offending source IP(s) at the WAF/reverse proxy and add a virtual-patch rule rejecting template directive syntax on non-admin input fields.
  2. Apply the Adobe APSB26-146 security update to all Adobe Commerce/Magento instances immediately, per CISA BOD 26-04 prioritization.
  3. If RCE is confirmed, isolate the affected web/app node from the pool and preserve it for forensics.

Evidence Collection

  1. Capture the raw web server access and error logs, PHP-FPM logs, and any WAF logs covering the exploitation window.
  2. Snapshot the Magento var/, pub/media/, generated/ and app/etc/ directories and compute hashes to detect webshells or modified config; export the process execution timeline from EDR.

Escalation Criteria

  • !Escalate to incident response if a shell/interpreter process was spawned by php-fpm/httpd or if new files appeared under web-writable directories after the request.
  • !Escalate if the injected directives reference objectManager, file reads of app/etc/env.php, or database/credential access, indicating data exposure beyond reflection.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web server access/error logs and PHP-FPM logs containing the directive payloads
  • >New or modified files under var/, pub/media/, generated/ and app/etc/env.php
  • >EDR process-tree records showing interpreters spawned from php-fpm/httpd/nginx

Tuning Guidance

Baseline legitimate admin template-editing traffic (typically authenticated sessions hitting /admin CMS block/email-template endpoints) and exclude those source IPs/user sessions. Restrict directive matching on anonymous storefront input fields (newsletter, sendfriend, customer forms) where directive syntax should never legitimately appear. Pair the HTTP-layer rules with the process-spawn EQL/CQL rules to raise confidence before paging.

Hunting Queries

Aggregates Magento template-directive requests by source IP and endpoint to surface systematic SSTI probing of CVE-2026-75650.

Hunting — KQL
kql 
AppServiceHTTPLogs | where CsUriQuery has_any ("{{block", "{{config", "objectManager", "filter/template") | summarize count() by CIp, CsUriStem, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=web (uri_query="*{{block*" OR uri_query="*{{config*" OR uri_query="*objectManager*") | stats count by src_ip, uri_path

Atomic Red Team Tests

Test 1 Magento template directive injection via newsletter field
linux

Submits a Magento template directive in a storefront field to simulate SSTI probing of CVE-2026-75650.

Command

bash 
curl -sk -X POST 'https://magento.lab.local/newsletter/subscriber/new/' --data-urlencode 'email={{config path="web/unsecure/base_url"}}@test.com'

Cleanup

bash 
curl -sk -X POST 'https://magento.lab.local/newsletter/subscriber/new/' --data-urlencode '[email protected]' >/dev/null 2>&1 || true

Expected Telemetry

Web access log entry to /newsletter/subscriber/new/ containing {{config ...}} directive syntax.

Expected Detection

KQL/SPL/Sumo/QRadar/Chronicle template-directive rules fire on the {{config directive in the request body.

Test 2 Template directive with objectManager reference
linux

Sends a request containing an objectManager reference typical of Magento SSTI-to-object-instantiation attempts.

Command

bash 
curl -sk 'https://magento.lab.local/sendfriend/product/sendmail/?message={{block%20class=%22Magento\\Framework\\ObjectManager%22}}'

Cleanup

bash 
echo 'no cleanup required'

Expected Telemetry

Web access log entry to /sendfriend/ with block/objectManager directive in the query string.

Expected Detection

Directive-matching HTTP rules match on {{block and objectManager tokens.

Test 3 Simulated SSTI-to-shell process spawn
linux

Simulates the post-exploitation behavior of the PHP worker spawning a shell, which the EQL/CQL process rules detect.

Command

bash 
sudo -u www-data bash -c 'php -r "system(\"id\");"'

Cleanup

bash 
echo 'no cleanup required'

Expected Telemetry

Process start event: php/php-fpm parent spawning bash and id under the www-data account.

Expected Detection

Elastic EQL and CrowdStrike CQL process rules fire on the shell/interpreter spawned by the web/PHP worker.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections