Active Zero-Day Exploit Targets Magento & Adobe Commerce
Unpatched 'StyleSmuggler' vulnerability allows remote code execution on e-commerce platforms
1Critical Vulnerability Discovered
Security firm Sansec uncovered a zero-day flaw called StyleSmuggler affecting Magento Open Source and Adobe Commerce. The vulnerability allows unauthenticated attackers to execute malicious code on servers. Active exploitation began on September 4, targeting current versions including 2.4.7 through 2.4.9. Adobe has not yet issued patches or advisories as of September 6.
2How the Attack Works
StyleSmuggler injects PHP code into Magento's template system using style properties to bypass security measures. The attack occurs in two phases: first poisoning the system with malicious code, then triggering execution through failed payment email processes. Notably, the exploit works even if email delivery fails, making detection challenging.
3Affected Versions
All current Magento Open Source versions are vulnerable, including fully patched systems. Sansec confirmed the exploit works on clean installations of 2.4.7, 2.4.8, and 2.4.9. One compromised store ran 2.4.6-p15 with Adobe's latest July-August 2026 security updates, proving even updated systems remain at risk.
4Real-World Compromises
Disrex Group independently verified attacks on two Magento Open Source stores (not Adobe Commerce). One victim ran version 2.4.8. Attackers installed persistent backdoors, granting ongoing server access. A third store was targeted but not breached. Web server rules have been updated based on captured attack traffic patterns.
5Detection Challenges
Unusual spikes in failed payment reminders may indicate compromise, though not conclusively. The attack doesn't require user interaction - code executes when Magento renders standard payment failure notifications. Security teams should monitor for abnormal system activity combined with payment failure surges.
6Current Mitigation Options
Sansec recommends temporarily disabling GraphQL for stores not running their Shield product. However, this breaks functionality for headless and progressive web app storefronts. Classic and Hyvä storefronts typically don't require GraphQL. Adobe's next scheduled security update is September 8, but patch inclusion remains uncertain.
7Technical Exploit Details
The attack leverages GraphQL-related handling and style properties to bypass input validation. Attackers place PHP code in Magento's templating path, then trigger evaluation during email rendering. This two-stage approach evades safeguards that normally block dangerous inputs, making the exploit particularly effective.
8Vendor Response Status
Adobe has not assigned a CVE identifier or published advisories. Their security bulletin index shows no updates since August 11. Sansec published early due to active compromises. Researchers reproduced the full attack chain on multiple versions, confirming widespread vulnerability across the platform.
9Attack Sophistication
StyleSmuggler represents advanced threat actor capabilities. The exploit requires no authentication, works on patched systems, and leaves minimal forensic evidence. Its two-phase design demonstrates careful platform understanding, suggesting attackers invested significant research into Magento's architecture.
10Business Impact
Successful compromises grant attackers full server control, enabling data theft, malware distribution, or ransomware deployment. E-commerce stores face particular risk during peak shopping seasons. The vulnerability affects both small businesses and enterprise implementations using vulnerable Magento versions.
11Historical Context
Magento has faced repeated security challenges, with previous vulnerabilities like Shoplift (2015) and MagentoCore (2019) causing widespread damage. The platform's popularity (28% of top 100k sites use it) makes it a prime target. This latest flaw continues a pattern of critical e-commerce platform vulnerabilities.
12Security Recommendations
Beyond temporary GraphQL disabling, merchants should monitor for unusual admin activity, review server logs for suspicious patterns, and prepare incident response plans. Organizations should pressure Adobe for urgent patches while evaluating alternative mitigation strategies. Regular security audits become critical until official fixes emerge.
Original article: The Hacker News — Active Zero-Day Exploit Targets Magento & Adobe Commerce