Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to: - use sendmail as the mail transport agent - have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | magento/community-edition (Packagist) | 1.9.0.0 to before 1.14.3.2 | 1.14.3.2 | Patch available | GHSA-26hq-7286-mg8f |
- magento/community-edition (Packagist) Vendor— Affected 1.9.0.0 to before 1.14.3.2 Fixed in 1.14.3.2 Patch available GHSA-26hq-7286-mg8f
Remediation
- Fix · GHSA-26hq-7286-mg8f magento/community-edition (Packagist) Fixed in 1.14.3.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-26hq-7286-mg8f
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences