Adobe Patches Actively Exploited Commerce Zero-Day
Security / news
Adobe Patches Actively Exploited Commerce Zero-Day
The unauthenticated flaw, nicknamed StyleSmuggler, disguised its backdoor traffic as ordinary NTP time-sync packets, security firm Sansec said.
An unauthenticated attacker can run arbitrary code on Adobe Commerce and Magento Open Source sites running versions 2.4.4 through 2.4.9, using a flaw researchers have nicknamed StyleSmuggler, Adobe said in a security bulletin published Sept. 7. No authentication or user interaction is required.
Adobe tracked the flaw as CVE-2026-75650, rated it Priority 1, its highest urgency level, and said it is aware of exploitation in the wild against Adobe Commerce merchants. E-commerce security firm Sansec, in its own research writeup, put a precise start on that exploitation: Sept. 4 at 22:20 UTC, three days before Adobe's patch shipped. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Sept. 8, setting a Sept. 11 remediation deadline for federal civilian agencies that run it.
How the attack works
Sansec said the exploit abuses a styles property in Magento's template engine to inject PHP code, then triggers execution by forcing the platform to render a "Payment Transaction Failed Reminder" email, a legitimate notification the attacker deliberately causes to fire. The two-step path means the attacker never has to log in or trick a user into clicking anything.
Adobe Commerce B2B versions 1.3.3 through 1.5.3 are also affected, and Adobe said versions 2.2, 2.3 and 2.4.0 through 2.4.3, though no longer supported, remain vulnerable to the same flaw.
A backdoor disguised as a time server
Sansec said the implant renamed its own process to blend in with normal system activity, first as kworker/u:8:0, then as fc-cache in a Sept. 6 build and chronyd in a Sept. 7 build. Its command-and-control traffic to 99.84.67.186:443 runs over TLS but is shaped to resemble NTP time-sync packets on port 123, with fallback domains including ntp.timesync.to and ntp.synctime.to. Sansec said a second, unrelated attacker used access gained through the same flaw to drop a separate PHP web shell inside the product-image cache directory, requiring a specific header to trigger.
What Adobe wants merchants to do beyond patching
Adobe's bulletin does not stop at the code fix, hotfix VULN-39341. It tells merchants to rotate their encryption key and then every credential that key may have protected: admin passwords, API tokens, integration credentials, payment gateway keys, database credentials and SSH keys. Cloud customers are told to redeploy so new database credentials take effect.
Neither Adobe's bulletin nor Sansec's writeup says how many merchants were compromised in the three days between first exploitation and the patch. Sansec said it was still cataloguing new backdoor variants as of its Sept. 7 build, which means the count of affected stores was still rising as this published. The Sept. 11 federal deadline is the next fixed date on the clock.
StyleSmuggler is the third vendor security disclosure this week that involves either an unauthenticated attack path or a design choice a vendor did not fully explain: it follows Microsoft's Sept. 8 Patch Tuesday, which fixed two actively exploited Windows zero-days, and Meta's admission that staff access to a user's Muse session is technically possible despite marketing the feature as secured by a dedicated virtual machine.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.