# Active Zero-Day Exploit Targets Magento & Adobe Commerce Unpatched 'StyleSmuggler' vulnerability allows remote code execution on e-commerce platforms - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-05 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/bdfa8cbb-dc62-466d-80a6-fbce97074a33 ## Critical Vulnerability Discovered Security firm Sansec uncovered a zero-day flaw called StyleSmuggler affecting Magento Open Source and Adobe Commerce. The vulnerability allows unauthenticated attackers to execute malicious code on servers. Active exploitation began on September 4, targeting current versions including 2.4.7 through 2.4.9. Adobe has not yet issued patches or advisories as of September 6. ## How the Attack Works StyleSmuggler injects PHP code into Magento's template system using style properties to bypass security measures. The attack occurs in two phases: first poisoning the system with malicious code, then triggering execution through failed payment email processes. Notably, the exploit works even if email delivery fails, making detection challenging. ## Affected Versions All current Magento Open Source versions are vulnerable, including fully patched systems. Sansec confirmed the exploit works on clean installations of 2.4.7, 2.4.8, and 2.4.9. One compromised store ran 2.4.6-p15 with Adobe's latest July-August 2026 security updates, proving even updated systems remain at risk. ## Real-World Compromises Disrex Group independently verified attacks on two Magento Open Source stores (not Adobe Commerce). One victim ran version 2.4.8. Attackers installed persistent backdoors, granting ongoing server access. A third store was targeted but not breached. Web server rules have been updated based on captured attack traffic patterns. ## Detection Challenges Unusual spikes in failed payment reminders may indicate compromise, though not conclusively. The attack doesn't require user interaction - code executes when Magento renders standard payment failure notifications. Security teams should monitor for abnormal system activity combined with payment failure surges. ## Current Mitigation Options Sansec recommends temporarily disabling GraphQL for stores not running their Shield product. However, this breaks functionality for headless and progressive web app storefronts. Classic and Hyvä storefronts typically don't require GraphQL. Adobe's next scheduled security update is September 8, but patch inclusion remains uncertain. ## Technical Exploit Details The attack leverages GraphQL-related handling and style properties to bypass input validation. Attackers place PHP code in Magento's templating path, then trigger evaluation during email rendering. This two-stage approach evades safeguards that normally block dangerous inputs, making the exploit particularly effective. ## Vendor Response Status Adobe has not assigned a CVE identifier or published advisories. Their security bulletin index shows no updates since August 11. Sansec published early due to active compromises. Researchers reproduced the full attack chain on multiple versions, confirming widespread vulnerability across the platform. ## Attack Sophistication StyleSmuggler represents advanced threat actor capabilities. The exploit requires no authentication, works on patched systems, and leaves minimal forensic evidence. Its two-phase design demonstrates careful platform understanding, suggesting attackers invested significant research into Magento's architecture. ## Business Impact Successful compromises grant attackers full server control, enabling data theft, malware distribution, or ransomware deployment. E-commerce stores face particular risk during peak shopping seasons. The vulnerability affects both small businesses and enterprise implementations using vulnerable Magento versions. ## Historical Context Magento has faced repeated security challenges, with previous vulnerabilities like Shoplift (2015) and MagentoCore (2019) causing widespread damage. The platform's popularity (28% of top 100k sites use it) makes it a prime target. This latest flaw continues a pattern of critical e-commerce platform vulnerabilities. ## Security Recommendations Beyond temporary GraphQL disabling, merchants should monitor for unusual admin activity, review server logs for suspicious patterns, and prepare incident response plans. Organizations should pressure Adobe for urgent patches while evaluating alternative mitigation strategies. Regular security audits become critical until official fixes emerge. ## Sources covering this story - [The Hacker News — Zero-Day Exploit Targets Magento and Adobe Commerce Stores](https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html) - [Security Affairs — StyleSmuggler Zero-Day Exploit Threatens Magento Stores](https://securityaffairs.com/198603/uncategorized/stylesmuggler-the-magento-zero-day-behind-new-store-attacks.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._