StyleSmuggler Zero-Day Hits Magento and Adobe Commerce Stores
A newly discovered zero-day vulnerability in Magento and Adobe Commerce is being actively exploited, putting online stores at risk of remote code execution without requiring attackers to authenticate. The vulnerability, dubbed StyleSmuggler, affects current versions of the platforms, including Magento Open Source 2.4.7, 2.4.8 and 2.4.9.
The attacks began on September 4, with the first confirmed exploitation recorded at 22:20 UTC. Security researchers have since reproduced the attack against clean installations, including systems running the latest available security patches. One of the first compromised stores was running Magento 2.4.6-p15 with its July and August 2026 patches already applied.
How StyleSmuggler Gets Into Magento
The attack abuses Magento's template system through its styles properties, allowing malicious PHP code to be injected while bypassing existing safeguards. The attack can begin by poisoning a template, including through the generation of a failure report, before using Magento's own failed-payment email process to execute the injected code.
The technique is particularly concerning because the malicious code does not depend on a store administrator opening an email. Magento executes the code while rendering the payment failure notification. Even if the email itself fails to reach its destination, the exploitation can still succeed.
Attackers Can Leave a Persistent Backdoor
Successful exploitation can result in a malicious background process being installed on the affected server. The backdoor identified so far is a small Rust-based program that connects to a command-and-control server and waits for instructions. Sansec said it has not yet found evidence that the backdoor has been weaponised.
Researchers also found signs that attackers attempted to disguise the malicious process as a legitimate Linux system process. Unexpected processes such as [kworker/u:8:0], along with unusual files and scheduled tasks, can indicate that a store has been compromised.
The investigation remains ongoing, and the security researchers said they were publishing their findings early because stores were already being compromised.
No Official Adobe Fix Yet
The timing leaves merchants with a narrow window to protect vulnerable installations. Adobe's next scheduled security bulletin is due on September 8, but it was not yet known whether that release would address StyleSmuggler.
As an emergency measure, merchants without a dedicated mitigation can temporarily disable GraphQL, while affected stores should also be checked for signs of a successful intrusion and secondary backdoors. The security researchers have already deployed detection and blocking rules for the attack.
The incident is another reminder that keeping an e-commerce platform patched does not always eliminate exposure when a previously unknown flaw is already being exploited. For Magento and Adobe Commerce operators, the immediate priority is determining whether their stores have been targeted and containing any compromise before attackers can use the access for further activity.
