StyleSmuggler RCE Hits Magento, Adobe Commerce
Unpatched 'StyleSmuggler' RCE Flaw Hits Magento & Adobe Commerce
Related Entities
Products & Tech
Other
Full Report
Executive Summary
Security firm Sansec has uncovered an unpatched, unauthenticated remote code execution (RCE) zero-day vulnerability, dubbed StyleSmuggler, that is being actively exploited to attack e-commerce websites. The vulnerability affects all current versions of Magento Open Source and Adobe Commerce, including the latest releases. The attack, first observed in the wild on September 4, 2026, allows a remote, unauthenticated attacker to inject malicious code and install a persistent backdoor on the server. The exploit chain involves abusing the platform's GraphQL API and template rendering system. As there is no official patch from Adobe, this poses a critical risk to thousands of online stores. Sansec recommends immediate mitigation by disabling the GraphQL endpoint if not in use and hunting for indicators of compromise.
Vulnerability Details
The StyleSmuggler exploit is a two-stage process that does not require any authentication:
Stage 1: Code Injection: The attacker sends a crafted GraphQL request to the target server. They abuse the
stylesproperties within the request to inject malicious PHP code into a server-side file. This could be a temporary file, a log file, or a report file that the application writes to.Stage 2: Code Execution: The attacker then triggers a server-side action that causes Magento's template system to parse the poisoned file. The researchers found that triggering the generation of a "Payment Transaction Failed Reminder" email is an effective method. During the email rendering process, Magento's dependency-injection scanner reads and executes the malicious PHP code from the file injected in Stage 1. This results in full RCE on the server. Crucially, the email does not need to be sent or opened; the execution happens entirely on the server during generation.
This sophisticated technique bypasses common security measures by smuggling code through a legitimate feature and using another legitimate feature to execute it.
Affected Systems
The vulnerability affects a wide range of versions, including:
- Magento Open Source / Adobe Commerce: 2.4.9, 2.4.8, 2.4.7
- Patched older versions: The first victim identified was running a fully patched Magento
2.4.6-p15instance.
Sansec has confirmed that all current versions are vulnerable, indicating a fundamental flaw in the template or GraphQL system.
Exploitation Status
Active Exploitation: Sansec confirmed that attacks began on September 4, 2026, and are ongoing. Attackers are using the exploit to install a persistent backdoor on compromised servers to maintain access and potentially steal payment data or inject credit card skimmers.
Impact Assessment
The impact of this vulnerability is critical. An unauthenticated RCE on an e-commerce platform allows an attacker to:
- Gain full control over the web server.
- Steal sensitive customer data, including personal information and payment details (PPCI).
- Install credit card skimming malware to capture payment information in real-time.
- Deface the website or use it to host other malicious content.
- Pivot into the victim's internal network.
For any online retailer, this can lead to devastating financial losses, regulatory fines (e.g., under GDPR or CCPA), and severe reputational damage.
IOCs — Directly from Articles
99.84.67.186247.cdnflare.xyz[kworker/u:8:0]Detection & Response
- Scan for IOCs: Immediately scan servers for the file-based and process-based IOCs listed above. Check
cronjobs for persistence mechanisms related to the backdoor. - Analyze Web Logs: Review web server access logs for suspicious GraphQL requests. Look for POST requests to
/graphqlthat contain unusual or obfuscated content within thestylesparameter. - File Integrity Monitoring: Monitor for unexpected changes or creation of PHP files in template, log, or report directories. The initial stage of the attack writes a file to disk.
- Review Outbound Traffic: Check firewall and DNS logs for any connections from your web server to the C2 IPs or domains listed in the IOCs.
Mitigation
As there is no official patch from Adobe, the following mitigations are crucial:
Disable GraphQL Endpoint (If Unused): If your store does not use the GraphQL API, disable it immediately. This is the most effective way to block the initial attack vector. This can often be done via web server configuration (e.g., Nginx or Apache) to block requests to the
/graphqlendpoint.Web Application Firewall (WAF): Deploy a WAF with rules specifically designed to detect and block malicious GraphQL queries. Sansec has released rules for its product, and other WAF providers may follow suit.
File Permissions: Ensure that web server processes have the most restrictive file permissions possible. While this may not block the initial write, it can hinder an attacker's ability to modify critical files or establish persistence.
Regularly Scan for Backdoors: Until a patch is available, conduct frequent scans of your server's filesystem and process list to look for indicators of compromise.
Timeline of Events
MITRE ATT&CK Mitigations
Disabling the GraphQL endpoint is the most effective mitigation if the feature is not used by the e-commerce store.
Restrict Web-Based Content
Using a WAF to filter and block malicious GraphQL requests can prevent the exploit from succeeding.
Antivirus/Antimalware
Endpoint security tools may be able to detect and block the Rust-based backdoor based on its signature or behavior.
D3FEND Defensive Countermeasures
The most immediate and effective mitigation for the StyleSmuggler vulnerability is to disable the GraphQL endpoint on your Magento/Adobe Commerce instance if it is not essential for your store's operation. This can be accomplished at the web server level. For Nginx, you can add a location block to your server configuration to return a 403 Forbidden or 404 Not Found error for any requests to /graphql. For Apache, a RewriteRule in your .htaccess file can achieve the same result. By blocking access to this endpoint, you remove the initial entry point for the attack, effectively neutralizing the threat until an official patch is released by Adobe. This is a critical hardening step that directly addresses the attack vector.
For stores that must keep the GraphQL endpoint active, deploying a Web Application Firewall (WAF) with specific rules to inspect GraphQL traffic is the next best line of defense. Configure your WAF to look for suspicious patterns within the styles property of GraphQL POST requests. Rules should be created to detect and block requests containing PHP tags (<?php), shell commands, or heavily obfuscated strings within this parameter. While attackers may attempt to bypass these rules, a well-configured WAF can significantly raise the difficulty of exploitation. Additionally, block all traffic from the known malicious IP address 99.84.67.186 at your network edge.
Given that the attack results in a backdoor being dropped, security teams should perform a full file integrity scan of their Magento/Adobe Commerce web servers. Use a tool to recursively scan the web root and system directories, comparing file hashes against a known-good baseline. Pay special attention to any recently modified files in log, report, or cache directories, as these are likely locations for the initial PHP code injection. Specifically search for a 1.9MB file that may be associated with the [kworker/u:8:0] process. Any identified malicious files should be quarantined and analyzed. This file-level analysis is crucial for confirming a compromise and beginning the cleanup process.
Timeline of Events
Sansec first observes active exploitation of the StyleSmuggler zero-day in the wild.
Sansec publishes its initial research and findings to alert merchants about the ongoing attacks.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.