Magento Open Source and Adobe Commerce can accept a dangerous filename through guest-cart custom option file metadata while validating the supplied bytes as an image. A GIF/PHP polyglot can therefore be persisted with a PHP extension under the custom option media area. The module discovers the active store code through GraphQL. When the catalog exposes exactly one in-stock product, it resolves the SKU automatically; catalogs with multiple candidates require the optional advanced SKU override. The vulnerable endpoint accepts the file metadata with an arbitrary numeric option identifier, which the module supplies internally. Upload acceptance is intermediate evidence only. The module proves PHP interpretation and operating-system command execution before committing an OSCI agent. Each OSCI command uses a new random, token-guarded GIF/PHP polyglot which deletes itself before running the requested command. Optional native Network-agent delivery uses curl and verifies the exit status of every installer command. The Network agent option is disabled by default. Execution depends on a web-server route that sends uploaded PHP files to PHP-FPM. A blocked media route is an execution-route precondition failure and does not prove that the unrestricted upload is patched. The OSCI agent runs commands with the privileges of the PHP service account and is not expected to be a superuser.

Magento Open Source and Adobe Commerce can accept a dangerous filename through guest-cart custom option file metadata while validating the supplied bytes as an image. A GIF/PHP polyglot can therefore be persisted with a PHP extension under the custom option media area. The module discovers the active store code through GraphQL. When the catalog exposes exactly one in-stock product, it also resolves the SKU automatically; catalogs with multiple candidates require the optional advanced SKU override. The vulnerable endpoint processes file metadata for an arbitrary numeric option identifier, so the module supplies an internal identifier and does not require an operator option value. The module tries the canonical Magento media routes /media and /pub/media. It proceeds only when the marker produces a dynamic PHP version and process identifier without returning PHP source. This execution condition depends on the web-server configuration; a blocked media route is not treated as proof that the upload primitive is patched. After confirming PHP interpretation and operating-system command execution, the module commits an OSCI agent. Every OSCI command is embedded in a new request-specific, token-guarded GIF/PHP polyglot that deletes itself before executing. Optional native Network-agent delivery uses curl and verifies the exit status of every installer command. By default no native Network agent is installed. The vendor CVSS vector describes user interaction. This module implements the separately published unauthenticated guest-cart laboratory path and should be used only where that endpoint and its product-option prerequisites are independently confirmed.

This module exploits CVE-2026-75650, a critical unauthenticated template injection vulnerability in Magento Open Source and Adobe Commerce known as StyleSmuggler. Improper neutralization of template-engine elements allows a remote attacker to execute arbitrary code through the Magento storefront. The exploit performs the following actions: Sends a crafted request to the Payflow transparent-response endpoint to create a Magento error report containing a PHP command runner. Extracts the generated report identifier and resolves its location. A configured REPORT DIRECTORY override is tried first; otherwise, the module tests paths relative to the Magento front controller. Creates an unauthenticated guest cart and assigns a guest email address. Stores the StyleSmuggler Preview block payload in the guest billing address. Triggers the failed-payment GraphQL path with a crafted styles object graph that includes the poisoned report. Confirms operating-system command execution with a harmless marker and deploys the selected Impact agent. By default, the module commits an interactive OSCI agent that replays the complete StyleSmuggler chain for every command and returns standard output. A Linux x86-64 Network Agent can be deployed as an alternative through the standard download-and-execute flow, which tries curl, wget, and BusyBox wget in that order. Commands and agents run with the privileges of the Magento web-server process. No Magento credentials are required. The module supports HTTP and HTTPS services, including IPv6 targets. Adobe lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines, Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier releases in those version lines, and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines as affected.

This module exploits CVE-2026-75650, a critical unauthenticated template injection vulnerability in Magento Open Source and Adobe Commerce known as StyleSmuggler. Improper neutralization of template-engine elements allows a remote attacker to execute arbitrary code through the Magento storefront. The exploit performs the following actions: Sends a crafted request to the Payflow transparent-response endpoint to create a Magento error report containing a PHP command runner. Extracts the generated report identifier and resolves its location. A configured REPORT DIRECTORY override is tried first; otherwise, the module tests paths relative to the Magento front controller. Creates an unauthenticated guest cart and assigns a guest email address. Stores the StyleSmuggler Preview block payload in the guest billing address. Triggers the failed-payment GraphQL path with a crafted styles object graph that includes the poisoned report. Confirms operating-system command execution with a harmless marker and deploys the selected Impact agent. By default, the module commits an interactive OSCI agent that replays the complete StyleSmuggler chain for every command and returns standard output. A Linux x86-64 Network Agent can be deployed as an alternative through the standard download-and-execute flow, which tries curl, wget, and BusyBox wget in that order. Commands and agents run with the privileges of the Magento web-server process. No Magento credentials are required. The target webpage supplies the HTTP or HTTPS scheme, host, port, and Magento installation path. Adobe lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines, Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier releases in those version lines, and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines as affected.

Windows Error Reporting preserves attacker-controlled command-line syntax across a privilege boundary and passes it to the elevated Time Travel Debugging recorder without preserving argument boundaries. The module performs the following steps: Generates a per-run x86_64 Core Impact agent executable with a random name. Stages the exploit and agent beneath a unique directory resolved from the target's public profile. Triggers the vulnerable WER/TTD workflow and preserves the per-run context in a randomly named manifest. Launches the standalone agent as SYSTEM outside the TTD-recorded process tree. Confirms the privileged callback and removes temporary exploit artifacts on a best-effort basis.

This module exploits an improper authentication vulnerability in the JFrog Access service used by JFrog Artifactory. In the vulnerable default configuration, Access trusts an additional cluster join key derived from an empty value. An unauthenticated remote attacker can use that known signing material to forge a valid HS256 cluster-join JWT and obtain a service identity without prior credentials. The forged service identity can then request an administrator-scoped access token. Successful authorization to an admin-only Artifactory endpoint demonstrates that the authentication boundary was bypassed. Important exploitation steps: Generate a fresh HS256 cluster-join JWT using the blank-key identifier and a generated service identifier. Submit the JWT to the unauthenticated Access registry-join endpoint and receive a service token. Exchange the service token for a non-refreshable administrator token with applied-permissions/admin scope, wildcard audience, and expires_in=0. Request the protected Artifactory system configuration endpoint with the administrator token. Confirm the vulnerability when the protected endpoint returns HTTP 200. Once this module validates the token, it is stored as a Core Impact HTTP identity so that it can be reused.

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

Windows Health and Optimized Experiences Service accepts a Microsoft.Windows.Diagnostics.Lua ETW workflow event containing an attacker-controlled Lua module path without adequately authenticating the event producer. The module performs the following steps: Generates a per-run x86_64 launcher containing a LittleInjectorEgg CORE Impact agent. Stages the short-lived launcher and prepares unique temporary Lua module and trace paths. Emits a Microsoft.Windows.Diagnostics.Lua ETW workflow start event referencing the controlled Lua module. Maintains the required trace interval and emits the matching workflow stop event. Causes the LocalSystem WHESVC process to execute the Lua module and launch the staged injector. Transfers the agent into spoolsv.exe, waits for the privileged callback, and removes temporary artifacts on a best-effort basis.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.