StyleSmuggler Magento and Adobe Commerce Zero-Day

September 06, 2026

Attackers are actively exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store’s server without logging in. Dutch e-commerce security company Sansec discovered the flaw and named it StyleSmuggler. Attacks started on September 4, 2026, and Adobe has not yet published an advisory, a CVE identifier, a patch, or a workaround as of September 6.

What Happened: StyleSmuggler Zero-Day Hits Magento and Adobe Commerce Stores

On September 4, 2026, Sansec detected active exploitation of a previously unknown vulnerability in Magento Open Source and Adobe Commerce. The flaw, dubbed StyleSmuggler, allows unauthenticated attackers to achieve remote code execution on affected online stores. Sansec warned that stores are being compromised right now and published its advisory early to help defenders respond quickly.

As of September 6, Adobe has not published a security advisory, assigned a CVE identifier, released a patch, or provided a workaround. The next Adobe security bulletin is scheduled for September 8, 2026, but it is not yet confirmed whether that release will address this flaw. All current versions of Magento Open Source and Adobe Commerce are affected, including version 2.4.9. Sansec successfully reproduced the full unauthenticated exploit chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. The first reported victim was running version 2.4.6-p15 with the July and August 2026 patches applied.

Technical Details of the StyleSmuggler Vulnerability

StyleSmuggler exploits Magento’s template system by abusing the styles properties to evade existing safeguards. The attack works in two stages. First, the attacker injects, or poisons, PHP code into the system. This can be done by generating a failure report that contains malicious code. Second, Magento executes the poisoned code when it renders a failed payment email. The vulnerability is unauthenticated, meaning attackers do not need valid credentials to exploit it.

When the attack succeeds, a persistent backdoor is installed on the server. Sansec’s analysis found that the backdoor is a small Rust program that connects to a command-and-control server at 99.84.67.186 and waits for further instructions. The backdoor disguises itself as a system process named [kworker/u:8:0], making it harder to detect. As of publication, the backdoor is not recognized by most security vendors.

Attack Vectors and Indicators of Compromise

• POST requests to /graphql with malformed styles parameters
• Unexpected bursts of Payment Transaction Failed Reminder emails
• Background processes named [kworker/u:8:0]
• Files in /tmp/.kw_* or ~/.local/share/.gvfsd/
• Crontab entries referencing gvfsd

Command-and-Control Infrastructure

• Malware download host: 247.cdnflare.xyz
• C2 server: 99.84.67.186:443 (WebSocket over TLS)
• Remote shell: windwsecurity.run:443
• NTP-shaped C2 traffic: ntp.timesysnc.net:123, time.microsft.run:123, pool.microsft.studio:123
• Attacker source IP: 88.216.72.181

Business and Operational Impact

Magento and Adobe Commerce power thousands of online stores worldwide. A successful StyleSmuggler attack gives attackers full control over the store’s server. The consequences can be severe and wide-ranging.

• Data theft: Customer payment information, personal details, and order histories can be stolen.
• Website defacement: Attackers can modify store content, prices, and product listings.
• Supply chain risk: Compromised stores may be used to distribute malware to customers.
• Reputational damage: Customers lose trust in brands that fail to protect their data.
• Regulatory fines: Data breaches may trigger penalties under GDPR, PCI-DSS, and other frameworks.
• Financial losses: Downtime, incident response costs, and lost sales can add up quickly.

Mitigation and Recommendations

Because Adobe has not yet released a patch, defenders must rely on detection and temporary workarounds. Sansec recommends the following immediate actions.

Immediate Actions for Defenders

1. Deploy a Web Application Firewall (WAF) rule to block GraphQL requests containing malformed styles parameters. Sansec Shield customers have had protection rules live since September 5, 2026.
2. Temporarily disable GraphQL if your store does not rely on it. This will prevent the primary attack vector from being exploited.
3. Scan for compromise using eComscan or a similar tool to detect implants and secondary backdoors.
4. Monitor for unexpected failed payment emails and investigate any sudden spikes.
5. Check running processes for suspicious [kworker/u:8:0] entries.
6. Rotate Magento admin credentials if any suspicious activity is detected.

Detection Commands

Run the following commands on your Magento server to check for indicators of compromise:

crontab -l | grep -i gvfsd
ls -la ~/.local/share/.gvfsd/ /tmp/.kw_* /tmp/.gvfsd-* 2>/dev/null
ps -eo pid,comm,args | grep -i kworker
grep -rl 'X_TRACE_' var/report/

Long-Term Hardening

• Apply Adobe’s patch immediately when it becomes available.
• Keep Magento and all extensions up to date.
• Restrict network access to Magento admin panels.
• Enable logging and alerting for suspicious GraphQL requests.
• Regularly audit file integrity and running processes.

Bottom line: StyleSmuggler is a critical unpatched vulnerability actively exploited in the wild. Store owners should disable GraphQL if possible, deploy WAF rules, and scan for compromise immediately. Stay alert for Adobe’s September 8 security bulletin and patch as soon as a fix is released.

Incident Summary

CVE ID / Incident:	StyleSmuggler (CVE pending)
Affected Systems:	Magento Open Source 2.4.7, 2.4.8, 2.4.9, Adobe Commerce (all current versions)
Disclosure Date:	September 5, 2026
Patch Status:	No patch available as of September 6, 2026. Next Adobe security bulletin scheduled for September 8, 2026.
Severity:	Critical (unauthenticated remote code execution)
Attack Vector:	GraphQL styles parameter injection leading to PHP code execution via failed payment email rendering
C2 Infrastructure:	99.84.67.186:443, windwsecurity.run:443, 247.cdnflare.xyz

References

1. Sansec Research, “StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack,” September 5, 2026. https://sansec.io/research/stylesmuggler (accessed September 6, 2026).
2. The Hacker News, “Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores,” September 5, 2026. https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce-zero-day.html (accessed September 6, 2026).
3. Adobe Commerce Security Bulletin Index, accessed September 6, 2026. https://helpx.adobe.com/security/products/magento.html.