StyleSmuggler RCE Hits Magento, Adobe Commerce
Unpatched 'StyleSmuggler' RCE Flaw Hits Magento & Adobe Commerce
Related Entities(initial)
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
Security firm Sansec has uncovered an unpatched, unauthenticated remote code execution (RCE) zero-day vulnerability, dubbed StyleSmuggler, that is being actively exploited to attack e-commerce websites. The vulnerability affects all current versions of Magento Open Source and Adobe Commerce, including the latest releases. The attack, first observed in the wild on September 4, 2026, allows a remote, unauthenticated attacker to inject malicious code and install a persistent backdoor on the server. The exploit chain involves abusing the platform's GraphQL API and template rendering system. As there is no official patch from Adobe, this poses a critical risk to thousands of online stores. Sansec recommends immediate mitigation by disabling the GraphQL endpoint if not in use and hunting for indicators of compromise.
Vulnerability Details
The StyleSmuggler exploit is a two-stage process that does not require any authentication:
Stage 1: Code Injection: The attacker sends a crafted GraphQL request to the target server. They abuse the
stylesproperties within the request to inject malicious PHP code into a server-side file. This could be a temporary file, a log file, or a report file that the application writes to.Stage 2: Code Execution: The attacker then triggers a server-side action that causes Magento's template system to parse the poisoned file. The researchers found that triggering the generation of a "Payment Transaction Failed Reminder" email is an effective method. During the email rendering process, Magento's dependency-injection scanner reads and executes the malicious PHP code from the file injected in Stage 1. This results in full RCE on the server. Crucially, the email does not need to be sent or opened; the execution happens entirely on the server during generation.
This sophisticated technique bypasses common security measures by smuggling code through a legitimate feature and using another legitimate feature to execute it.
Affected Systems
The vulnerability affects a wide range of versions, including:
- Magento Open Source / Adobe Commerce: 2.4.9, 2.4.8, 2.4.7
- Patched older versions: The first victim identified was running a fully patched Magento
2.4.6-p15instance.
Sansec has confirmed that all current versions are vulnerable, indicating a fundamental flaw in the template or GraphQL system.
Exploitation Status
Active Exploitation: Sansec confirmed that attacks began on September 4, 2026, and are ongoing. Attackers are using the exploit to install a persistent backdoor on compromised servers to maintain access and potentially steal payment data or inject credit card skimmers.
Impact Assessment
The impact of this vulnerability is critical. An unauthenticated RCE on an e-commerce platform allows an attacker to:
- Gain full control over the web server.
- Steal sensitive customer data, including personal information and payment details (PPCI).
- Install credit card skimming malware to capture payment information in real-time.
- Deface the website or use it to host other malicious content.
- Pivot into the victim's internal network.
For any online retailer, this can lead to devastating financial losses, regulatory fines (e.g., under GDPR or CCPA), and severe reputational damage.
IOCs — Directly from Articles
99.84.67.186247.cdnflare.xyz[kworker/u:8:0]Detection & Response
- Scan for IOCs: Immediately scan servers for the file-based and process-based IOCs listed above. Check
cronjobs for persistence mechanisms related to the backdoor. - Analyze Web Logs: Review web server access logs for suspicious GraphQL requests. Look for POST requests to
/graphqlthat contain unusual or obfuscated content within thestylesparameter. - File Integrity Monitoring: Monitor for unexpected changes or creation of PHP files in template, log, or report directories. The initial stage of the attack writes a file to disk.
- Review Outbound Traffic: Check firewall and DNS logs for any connections from your web server to the C2 IPs or domains listed in the IOCs.
Mitigation
As there is no official patch from Adobe, the following mitigations are crucial:
Disable GraphQL Endpoint (If Unused): If your store does not use the GraphQL API, disable it immediately. This is the most effective way to block the initial attack vector. This can often be done via web server configuration (e.g., Nginx or Apache) to block requests to the
/graphqlendpoint.Web Application Firewall (WAF): Deploy a WAF with rules specifically designed to detect and block malicious GraphQL queries. Sansec has released rules for its product, and other WAF providers may follow suit.
File Permissions: Ensure that web server processes have the most restrictive file permissions possible. While this may not block the initial write, it can hinder an attacker's ability to modify critical files or establish persistence.
Regularly Scan for Backdoors: Until a patch is available, conduct frequent scans of your server's filesystem and process list to look for indicators of compromise.
Timeline of Events
Article Updates
September 8, 2026
Severity decreasedAdobe released an emergency patch (CVE-2026-75650, CVSS 10.0) for the 'StyleSmuggler' RCE zero-day, urging immediate application.
Adobe has released an emergency security update for the 'StyleSmuggler' RCE zero-day, now officially tracked as CVE-2026-75650 with a critical CVSS score of 10.0. The patch addresses the unauthenticated remote code execution vulnerability affecting Adobe Commerce and Magento Open Source. Exploitation, which began on September 4, 2026, has been observed originating from IP addresses in China and Romania. Administrators are strongly advised to apply the patch immediately to mitigate the risk of compromise and to investigate for signs of active exploitation.
Update Sources:
Timeline of Events
Sansec first observes active exploitation of the StyleSmuggler zero-day in the wild.
Sansec publishes its initial research and findings to alert merchants about the ongoing attacks.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.