StyleSmuggler CVE-2026-75650: Zero-Day RCE Actively Exploited Against Magento and Adobe Commerce
StyleSmuggler CVE-2026-75650: Zero-Day RCE Actively Exploited Against Magento and Adobe Commerce
E-commerce storefronts running Magento and Adobe Commerce are under active zero-day attack. Security researchers at Sansec have disclosed "StyleSmuggler," a vulnerability tracked as CVE-2026-75650 and rated a maximum CVSS 10.0, which allows unauthenticated attackers to execute arbitrary code on vulnerable stores. Exploitation has been observed in the wild since September 4, 2026, with attackers deploying Rust-based Linux backdoors on compromised instances. Adobe published an emergency hotfix under APSB26-146 on September 7.
How the Exploit Works
The attack unfolds in two stages. First, the attacker injects malicious PHP code into a file that Magento itself writes — such as system logs or failure reports. Second, the attacker deliberately triggers Magento's standard "Payment Transaction Failed Reminder" email. During the template rendering process for that email, Magento's dependency-injection code scanner classes are redirected to the poisoned file, executing the attacker's PHP. The exploit succeeds even when email delivery fails, because the critical code execution happens during rendering, not delivery.
According to Sansec's analysis, Magento Open Source versions 2.4.4 through 2.4.9 are vulnerable, with exploitation already confirmed on versions 2.4.7, 2.4.8, and 2.4.9. All current Adobe Commerce and Adobe Commerce on Cloud versions are considered potentially vulnerable.
The Payload
Post-exploitation, attackers drop a roughly 1.9 MB statically linked Rust binary. Early variants disguise themselves as the Linux kernel thread [kworker/u:8:0]; newer versions impersonate fc-cache or chronyd. Persistence is established through a cron job that repeats every 30 minutes. Early variants communicated with command-and-control servers over TLS and WebSockets, while newer ones hide their C2 traffic in UDP packets to port 123 disguised as NTP — using hostnames that mimic time-sync infrastructure such as ntp.timesync.net and time.microsft.run.
What Should You Do?
- Apply the Adobe hotfix now. Deploy the VULN-39341 hotfix for CVE-2026-75650 published under APSB26-146. Patching does not clean an already-compromised store, so pair it with compromise checks.
- Use interim mitigations if you cannot patch immediately. Sansec recommends temporarily disabling GraphQL, adding
proc_opento PHP'sdisable_functions, and mounting /tmp, /var/tmp, and /dev/shm with the noexec flag. - If compromise is confirmed, assume everything is burned. Flush session storage (including Redis), rotate the Magento encryption key, and reset every credential it protects — admin passwords, REST/SOAP/GraphQL integration tokens, OAuth secrets, payment gateway credentials, database credentials, SSH and deploy keys, and third-party extension API keys.
- Watch for the indicators. Hunt for the published C2 hostnames, attacker source IPs, and binary hashes in Sansec's indicators of compromise.
The WAF Angle
StyleSmuggler is a hard case for signature-based defenses: the exploit chain runs through legitimate application features — log writes, report generation, email template rendering — rather than a payload a WAF pattern-matches out of the box. That said, the injection stage requires the attacker to place PHP code into data your storefront will later write to disk, and that traffic often looks anomalous at the request layer. WAF policies tuned for PHP code fragments in unusual parameters, combined with file-integrity monitoring and egress filtering for NTP-shaped C2 beacons, give defenders layered coverage no single control can provide. E-commerce operators should plan as if a maximum-severity zero-day in the platform is a when, not an if — and design detection around what the payload does after it lands.
