StyleSmuggler zero-day hits Magento and Adobe Commerce stores

Sansec Forensics published a threat-research advisory on 5 September 2026, last updated 6 September at 21:30 UTC, on StyleSmuggler, an unpatched Magento Open Source and Adobe Commerce zero-day that gives unauthenticated remote code execution. All current versions are affected, including 2.4.9. The write-up is Sansec research with live exploitation evidence, not an Adobe PSIRT bulletin, not a CVE assignment (none exists yet), and not a CISA Known Exploited Vulnerabilities listing.

Attacks started 4 September 2026, with the first confirmed exploitation around 22:20 UTC. Sansec found the campaign at 22:40 UTC the same day. The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and a clean security:patch-status. Sansec later reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9.

The chain is two-stage. Attackers inject or poison PHP through styles properties, for example a failure report, then execute it when Magento renders a failed-payment email. A burst of Payment Transaction Failed Reminder messages is a clue. The code runs during render even if the email never delivers.

A GraphQL path is involved (POST /graphql?styles[....]=). Stores that do not run Sansec Shield are told to disable GraphQL until Adobe ships a fix.

Adobe's next scheduled security bulletin is 8 September 2026. Sansec says it is unknown whether that bulletin covers this bug. There was no Adobe advisory or CVE at publication. Sansec is publishing early because stores are being compromised now, and the write-up may change as the investigation continues.

The implant is a Rust backdoor. Early builds disguise as [kworker/u:8:0]. September 6 builds use the name fc-cache (version 2.1.4 observed) and beacon over NTP-shaped UDP to ntp.timesync.to on port 123. C2 also includes 99.84.67.186.

Sansec says it has no indication the backdoor has been used for further commands yet, and still frames any implant as a compromise. Shield rules went live the morning of 5 September, eComscan 1.9.7 terminates known processes, and credentials should be rotated if a suspicious process shows up.

Unauthenticated remote code execution on internet-facing platforms is the same class of event as SonicWall SMA 1000 zero-days under active attack and a WordPress migration plugin takeover.

Some offers on this page may be paid placements or contain affiliate links.