StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited

Attackers are actively exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution and persistent backdoor installation. Dutch e-commerce security firm Sansec discovered the flaw, named StyleSmuggler, and published an early advisory on September 5, 2026, warning that online stores were already being compromised. As of September 7, 2026, Adobe has not issued a CVE identifier, an advisory, a patch, or a workaround.

What Is StyleSmuggler?

StyleSmuggler is an unauthenticated remote code execution vulnerability affecting Magento Open Source and Adobe Commerce. The flaw allows an attacker to execute arbitrary code on a store’s server without any authentication, then install a persistent backdoor.

No CVE identifier or CVSS score has been assigned. Adobe’s security bulletin index lists nothing after the late August 2026 updates. Sansec has not yet published the full exploit chain, and public technical details remain limited.

The attack works in two stages. In the first stage, the attacker plants PHP code in a file that Magento itself writes, such as a failure report or a system log. In the second stage, the attacker triggers Magento’s built-in “Payment Transaction Failed Reminder” email. The planted code executes while Magento renders the email template. No one needs to open the email, and the attack can succeed even if email delivery fails entirely.

A successful attack results in full server-side code execution and the deployment of a persistent backdoor binary.

Which Magento and Adobe Commerce Versions Are Affected?

Sansec states that all current versions are affected. The company reproduced the full unauthenticated exploit chain on clean Magento Open Source installations across multiple release lines. One confirmed victim was running the latest available patch level with both the July and August 2026 security updates applied.

Sansec has not published a reproduction on Adobe Commerce or Adobe Commerce on Cloud, and Adobe has not confirmed which product lines or versions are affected. Defenders should treat Magento Open Source or Adobe Commerce deployment as potentially vulnerable and act with caution until Adobe provides clarification.

How Could StyleSmuggler Be Exploited?

The attack requires only access to the store’s public-facing application. It does not require authentication or admin panel access.

Based on available reporting, the exploit chain targets Magento’s dependency-injection code scanner classes. A directive within the injected content drives a sequence of Magento’s own classes into code paths that exist solely to serve the command-line dependency-injection compiler. Those code paths end by including a file path the attacker controls: the log or report file poisoned in the first stage. The executed PHP code then attempts six PHP functions in sequence to start a process, downloads a binary payload, and launches the backdoor implant.

The implant is a stripped, statically linked Rust program of roughly 1.9 MB built for x86-64 and arm64. It disguises itself as a Linux kernel thread, installs a cron entry that restarts it every five minutes, and writes directly to the cron spool file, avoiding the normal crontab replacement path and its associated logging.

Public reporting indicates that the implant can read Magento session storage through the store’s Redis instance. In at least one observed case, no outbound connection to a command-and-control server was detected while the implant was active.

Is StyleSmuggler Being Actively Exploited?

Yes. Sansec observed active exploitation beginning on September 4, 2026, and published its early advisory the following day specifically because stores were being compromised in real time.

Independent incident-response evidence from Disrex Group, a Magento hosting company, confirms exploitation across at least two stores running Magento Open Source. Both stores were breached within an eight-hour window between the first observed attack and the availability of any defensive measure.

CISA has not added StyleSmuggler to its Known Exploited Vulnerabilities (KEV) catalog as of September 7, 2026. No CVE has been assigned, which may delay formal cataloging.

Multiple source IP addresses have been observed across confirmed incidents, including both hosting infrastructure and residential proxy pools, indicating the campaign is not limited to a single attacker address. No threat actor attribution has been published.

SOCRadar’s Cyber Threat Intelligence module enables organizations to track StyleSmuggler developments in real time, including CVE assignment status, vendor advisory updates, CISA KEV catalog additions, public PoC developments, and exploitation reporting as the situation evolves.

What Should Defenders Do Now?

Disable GraphQL as an Interim Measure

Sansec’s primary interim recommendation is to temporarily disable GraphQL on affected stores until Adobe releases a fix. Headless and progressive web app storefronts that depend on GraphQL will be affected by this measure. Classic Magento and Hyva storefronts generally do not require GraphQL.

Apply Server-Level Hardening

Two server-level settings reduce exposure regardless of the specific exploit chain. Adding proc_open to PHP’s disable_functions directive blocks the dropper’s preferred method for starting the implant. Mounting /tmp, /var/tmp, and /dev/shm with the noexec flag prevents downloaded binaries from executing in those directories.

Review Unofficial Community Mitigations

Multiple independent parties have published unofficial mitigations on GitHub, including source patches that prevent Magento’s dependency-injection code scanner methods from running outside the command line. These patches were developed during active incident response and have not been reviewed or endorsed by Adobe or Sansec. Administrators should evaluate them carefully before applying to production systems.

Check for Indicators of Compromise

Search var/report/ and var/log/system.log for unexpected content, including injected markers or unusual PHP code. Review running processes for names resembling Linux kernel threads (bracketed process names like [kworker/u:8:0]) owned by non-root site users. Inspect cron spool files for unexpected entries pointing to hidden directories under the site user’s home path.

Unexpected bursts of “Payment Transaction Failed Reminder” emails, especially those containing unresolved template variables or zero-amount totals, may indicate exploitation attempts.

Rotate Credentials

For any store where compromise indicators are found, flush session storage, rotate the Magento encryption key (crypt/key in app/etc/env.php), and reset all admin passwords, payment provider API keys, and integration credentials.

Monitor for Adobe’s Response

Adobe’s next scheduled security release is September 8, 2026. It is not yet known whether that release will address StyleSmuggler. Defenders should monitor Adobe’s security bulletin page and Sansec’s advisory for updates.

How Can SOCRadar Help?

SOCRadar’s Attack Surface Management module helps identify internet-facing Magento and Adobe Commerce deployments, exposed storefronts, vulnerable technologies, and related infrastructure across your organization’s digital footprint, supporting rapid prioritization of stores that require immediate mitigation or compromise assessment.