www.it-connect.fr
Magento StyleSmuggler Zero-Day Patched After Active Exploitation
Do you manage an online store powered by Magento or Adobe Commerce? Take a moment to read this. A zero-day security flaw nicknamed StyleSmuggler has been exploited since September 4, 2026 to install a backdoor on servers. In response to this threat, Adobe has released an emergency security patch. Here is what you need to know.
It all started on September 5, when Sansec published a report about an unknown vulnerability discovered in Magento and being actively exploited. At the time, the situation was rather alarming because no patch was available. In fact, a first store was compromised through this security flaw as early as September 4: it was still a fully up-to-date store. In other words, being patched was not enough.
Two days later, on September 7, Adobe published an official security bulletin about this flaw, now tracked as CVE-2026-75650, aka StyleSmuggler. This makes it clear that this is a critical security vulnerability with a CVSS score of 10 out of 10.
"This update addresses a critical vulnerability that could lead to arbitrary code execution. Adobe is aware of exploitation of CVE-2026-75650 in the wild", the bulletin states.
StyleSmuggler: an injection in the template engine
According to Adobe, this vulnerability is located in the template engine. It can be exploited with no authentication and no user interaction whatsoever. The attacker only needs to be able to visit the online store.
According to Sansec, the attack takes place in two stages. The attacker first injects malicious PHP code into Magento's template system by abusing style properties to bypass existing protections. Then, they trigger the sending of a failed payment reminder email, titled "Payment Transaction Failed Reminder". It is when this email is rendered that Magento executes the injected code. But nobody needs to open the message, which confirms the "no user interaction" nature of this flaw.
On compromised servers, attackers have apparently taken to deploying a Rust-based backdoor. It disguises itself as a system process, under the name kworker or fc-cache, and copies itself into the ~/.cache/fontconfig/ directory. As for traffic between the compromised instance and the attackers' C2 server, it is disguised as NTP traffic, with UDP packets sent over port 123 to hostnames mimicking time servers. In another case, the Rust backdoor is replaced by a PHP web shell.
How can you protect yourself from the StyleSmuggler flaw?
Adobe has released a hotfix to be applied as a Composer patch. If you need help, Adobe's published release note explains the procedure. The affected versions are as follows:
- Adobe Commerce: versions 2.4.4 through 2.4.9, including August 2026 releases and earlier in each branch
- Adobe Commerce B2B: versions 1.3.3 through 1.5.3, including August 2026 releases and earlier
- Magento Open Source: versions 2.4.6 through 2.4.9, including August 2026 releases and earlier
Even though the patch blocks exploitation of the vulnerability, Adobe recommends taking additional steps, including full secret rotation. This is especially important if you notice an unusual increase in "Payment Transaction Failed Reminder" emails: it may be a sign that your store has been compromised, or at least that an attempt is underway.
As a reminder, this is not the first major security alert of 2026 on this e-commerce platform. In March 2026, the PolyShell flaw had already been exploited at scale, with compromised stores used to steal customers' banking data using an SVG image.
