Magento Zero-Day Compromised a Store Within 50 Minutes
Security / news
Magento Zero-Day Compromised a Store Within 50 Minutes
CVE-2026-75650, dubbed StyleSmuggler and rated CVSS 10.0, let unauthenticated attackers plant a Rust backdoor disguised as a kernel process before Adobe's hotfix shipped three days later.
[No account or credentials needed] An unauthenticated attacker can plant a backdoor on any unpatched Adobe Commerce or Magento Open Source store by abusing a flaw the e-commerce security firm Sansec calls StyleSmuggler, according to a Sansec report published Sept. 5.
Sansec and Adobe track the bug as CVE-2026-75650, rated 10.0 out of 10 on the CVSS scale. It affects Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, and Adobe Commerce B2B versions 1.3.3 through 1.5.3, Sansec said. Unsupported branches from 2.2 through 2.4.3 are also vulnerable, though Adobe no longer patches them directly.
The timeline from first hit to hotfix
- Sept. 4, 10:20 p.m. UTC: Sansec records the first confirmed exploitation; a store managed by e-commerce platform Disrex is compromised within 50 minutes.
- Sept. 5, 7:15 a.m. UTC: Sansec's Shield product begins blocking the attack pattern.
- Sept. 7, 8:20 p.m. UTC: Adobe ships emergency hotfix APSB26-146.
- Sept. 8: CISA adds CVE-2026-75650 to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until Sept. 11 to patch.
How StyleSmuggler gets code onto a store
The attack works in two requests. The first injects malicious PHP into Magento's template system through its "styles" properties, bypassing the safeguards meant to stop exactly that. The second causes Magento's template-processing chain to reach a dependency-injection scanner that loads the poisoned file using PHP's include or require_once, which execute code rather than just reading it, Sansec said. The trigger event is Magento rendering a routine "Payment Transaction Failed Reminder" email, so the attack hides inside normal store activity.
What landed on compromised stores
Attackers installed a Rust-based Linux backdoor that connects to an external server and waits for instructions, disguising itself under process names like [kworker/u:8:0] or fc-cache to blend into normal system activity, plus a PHP dropper that installs web shells, according to BleepingComputer's reporting. Telemetry from Previdian recorded 12 exploitation attempts from two IP addresses, in China and Romania, as of Sept. 7.
How exposed the platform is
More than 160,000 websites run Magento, including roughly 14,000 of the top 1 million sites on the internet, according to BleepingComputer, and every one running an unpatched 2.4.4 through 2.4.9 build was reachable by a request that needs no account at all. It is the same no-credentials-needed shape CISA catalogued in September for chained flaws in JFrog's Artifactory, and CISA added it to its exploited-vulnerabilities catalog the same week it flagged two unrelated Patch Tuesday zero-days under active attack.
Which versions need the Sept. 7 hotfix
| Product | Versions | Fix |
|---|---|---|
| Adobe Commerce / Magento Open Source | 2.4.4 – 2.4.9 | Hotfix VULN-39341 composer patch |
| Adobe Commerce B2B | 1.3.3 – 1.5.3 | Same hotfix |
| Unsupported branches | 2.2.0 – 2.4.3-p3 | No official Adobe fix; Scandiweb backported the patch to 41 versions |
What patching alone does not fix
Adobe's hotfix guidance includes rotating encryption keys and associated credentials as part of remediation, The Hacker News reported, because a StyleSmuggler compromise can expose the keys Magento uses to protect stored payment and customer data. Neither Sansec nor Adobe has said how many stores were compromised in the three days between the first attack and the hotfix, or whether backdoors installed during that window survive on stores that patched the code flaw but never rotated those keys.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.