StyleSmuggler: an actively exploited zero-day in Magento and Adobe Commerce

Update (8 September 2026): On 7 September 2026 Adobe released an official fix for this flaw – security bulletin APSB26-146, tracked as CVE-2026-75650. The fix is hotfix VULN-39341, and after applying it Adobe requires you to rotate your encryption key and every credential that may have been encrypted or exposed with it: admin passwords, integration and API tokens, payment gateway keys, database and server access. Adobe confirms the flaw was exploited in the wild against merchants. The full version list and patching instructions are here: Adobe help – APSB26-146. If you run a Magento or Adobe Commerce store, update it now. The text below describes the situation before the fix was released.

If you run a store on Magento or Adobe Commerce, this one is urgent. Real-world attacks have been under way since 4 September 2026, and as of this writing (7 September 2026) Adobe has not released an official fix. Worse still, your store’s current patch level does not protect you against this flaw. Below we explain what is happening, how to check in minutes whether your server has been hit, and what to do right now.

What StyleSmuggler is and who is affected

StyleSmuggler is the name given to a new, critical flaw in Magento, disclosed on 5 September 2026 by the Sansec Forensics Team. Its key traits:

Type: unauthenticated remote code execution (RCE). An attacker needs no account in your store to take over the server.
Zero-day: at the time of disclosure there was neither an official CVE number nor a patch from Adobe.
Status: the flaw is being actively exploited. Attacks are ongoing, with the first confirmed cases recorded on 4 September 2026 at roughly 22:20 UTC.

The most alarming part is that being up to date on patches is no defence here. Sansec confirmed the full attack chain on clean installations of 2.4.7, 2.4.8 and 2.4.9, and the first known victim was a store on 2.4.6-p15 with the full July and August 2026 patch set and a clean bin/magento security:patch-status. That means every currently supported version of Magento Open Source and Adobe Commerce is exposed, no matter how diligently it has been patched.

The flaw does not spare B2B stores. Adobe Commerce with the B2B module is just as vulnerable as a plain B2C install, and in the former the stakes are higher: contract pricing, company data, wholesale orders and standing in the supply chain.

How the attack works

We describe the mechanism in general terms, without working code, so this helps defenders rather than attackers. The attack has two stages and abuses built-in Magento features:

Poisoning. The attacker injects malicious PHP into a location Magento itself writes to disk, such as error reports or logs.
Execution. It then forces the platform to run the poisoned code through Magento’s template system, using among other things the styles property, {{block}} directives and an object chain that ends in including a file the attacker points to.

The email vector is characteristic here. The attack is often tied to generating “Payment Transaction Failed Reminder” messages, and the malicious code runs while such an email is being rendered. Nobody has to open it, and the attack can succeed even when the message itself fails to send.

In access logs the traces most often show up as POST /graphql?styles[...]= requests, along with traffic on endpoints tied to the PayPal transparent response and customer section load.

What happens after a successful attack

The result is full control of the server. Sansec is seeing the installation of an implant (a backdoor) written in Rust, which masquerades under system process names such as [kworker/u:8:0], and in a newer variant from 6 September as fc-cache. The implant secures persistence through cron entries (for example every 5 minutes or twice an hour) and talks to a command-and-control server over, among others, WebSocket and traffic disguised as NTP on port 123.

So far there are no public reports of these backdoors being used at scale for follow-on activity such as card skimming. That is cold comfort: the attacker has free rein on the server and can move to the next step at any moment.

How to check whether your store has been hit

The commands below are read-only, change nothing, and you can run them right away. Run them on the store’s server, and in the Magento install root where a check concerns project files.

Suspicious processes disguised as kernel tasks:

ps -eo pid,user,rss,args --no-headers | awk '$4 ~ /^\[/ && $2 != "root"'

Cron entries left by the implant:

crontab -l | grep -i gvfsd

Characteristic files and directories:

ls -la ~/.local/share/.gvfsd/ ~/.cache/fontconfig/fc-cache /tmp/.kw_* /tmp/.fc-* 2>/dev/null

Traces of injected PHP in reports and logs:

grep -ril 'x_trace_\|X_TRACE_\|<?php' var/report/ var/log/

In addition, search your access logs for the strings styles[, styles%5B, and references to generatorClass or cdnflare. If any of these checks return a result, treat the server as potentially compromised and move to the response section.

What to do right now

Because Adobe has not shipped a patch yet, defence rests on temporary mitigations. Adobe’s next scheduled security bulletin falls on 8 September 2026, but it is not certain it will cover StyleSmuggler. Until an official fix exists, patch level is not a measure of security.

Recommended preventive steps:

Turn on real-time protection. Sansec Shield blocks known variants of this attack at the inbound-traffic layer.
Consider temporarily disabling GraphQL if you have no web application firewall (WAF) in front of the store. This is Sansec’s own recommendation, because the main vector runs through GraphQL.
Use the eComscan scanner from Sansec to detect implants.
Treat community patches with caution. Emergency fixes are circulating (from Disrex and graycore, among others) that harden the DI scanners to CLI-only mode and add nginx or Apache rules. They are unofficial, they do not remove an existing infection, and you should test them on staging first.

If you have found signs of compromise, the order is: preserve evidence, remove the malware and any secondary backdoors, rotate every password and key (admin panel, database, SSH, API), then consider a full audit and a rebuild from a clean backup taken before the attack.

It is also worth watching outbound mail closely. Warning signs include sudden waves of “Payment Transaction Failed” messages and suspicious emails with unresolved {{var ...}} tags, addresses in the .invalid domain, or content-generation errors.

Selected indicators of compromise (IoC)

Processes and files:

processes [kworker/u:8:0] and fc-cache
~/.local/share/.gvfsd/gvfsd-user
~/.cache/fontconfig/fc-cache
/tmp/.kw_*, /tmp/.fc-*

Network:

247.cdnflare.xyz, 209.141.43.95
99.84.67.186:443, windwsecurity.run
ntp.timesync.to, ntp.synctime.to and similar (UDP 123)
one attack source: 88.216.72.181

A sample implant hash:

e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7

Bear in mind that the indicator list keeps shifting. The attackers have already renamed the process once and will keep doing so, so failing to match the list above is not proof that all is well.

Why this matters for B2B stores and companies with a PIM

StyleSmuggler is a clear reminder that platform security is not optional but foundational. A large catalogue, ERP integrations, complex pricing policy and many users do not protect you from RCE. If anything the opposite is true: the more elaborate the B2B store, the more sensitive data ends up in an attacker’s hands.

There is a lesson here for companies putting their product data in order too. Even the best PIM system will not help if the sales platform is taken over. Consistent product data and a secure platform are two pillars of scalable B2B that cannot be separated. Regular updates, a web application firewall and process monitoring on the server are the baseline today, not an add-on.

Need help updating or auditing your store?

If you are not sure whether your store is safe, or you would like to walk through the checks and mitigations above with someone who does this every day, we can help. We handle Magento support and maintenance and Magento store audits. Reach out through our contact form and we will work out what to tackle first.

Sources

Sansec, StyleSmuggler write-up: sansec.io/research/stylesmuggler
Adobe’s official fix, released 7 September 2026: bulletin APSB26-146 (CVE-2026-75650)

This article reflects the situation as of 7 September 2026. Things are moving fast, so once an official patch is out, update Magento as quickly as you can and verify the server against the indicators listed above.