Adobe Commerce Hit by a CVSS 10 Zero-Day Called StyleSmuggler
Security / news
Adobe Commerce Hit by a CVSS 10 Zero-Day Called StyleSmuggler
Sansec found attackers backdooring stores with a Rust implant three days before Adobe's Sept. 7 hotfix, and patching alone doesn't clean an infected site.
Attackers began exploiting an unauthenticated, maximum-severity flaw in Adobe Commerce and Magento on Sept. 4, three days before Adobe shipped an emergency hotfix, according to the security firm that found it.
Sansec, the e-commerce security firm that discovered the bug, said it confirmed the first attack at 22:20 UTC on Sept. 4. Adobe published hotfix VULN-39341 on Sept. 7 at 20:20 UTC, then updated its bulletin, APSB26-146, on Sept. 11 to confirm exploitation in the wild. The flaw, CVE-2026-75650, carries the maximum CVSS score of 10.0 and affects Commerce and Magento Open Source 2.4.4 through 2.4.9, plus Commerce B2B 1.3.3 through 1.5.3.
How StyleSmuggler runs code with no login required
The bug lets an unauthenticated attacker inject PHP into Magento's template system by abusing the platform's styles properties, which Sansec said "can evade existing safeguards." The injected code runs when Magento renders its "Payment Transaction Failed Reminder" email, turning a routine notification into remote code execution.
One compromised store Sansec examined was running Magento 2.4.6-p15 with every prior patch applied, proof that a current patch level offered no defense against a flaw nobody had fixed yet.
What attackers installed once they were in
Sansec found a Rust-compiled backdoor connecting to command-and-control server 99.84.67.186, disguised under process names including kworker/u:8:0, fc-cache and chronyd, and beaconing every 60 seconds using traffic made to look like NTP time syncs. A separate 485-byte PHP dropper wrote web shells into the pub/media/catalog/product/cache directory, activated only by a specific X-Cache-Token header. Later intrusions added the gs-netcat tunneling tool and a remote-access trojan called WraithC2, reaching databases through uploaded Adminer panels, according to Sansec.
The Hacker News reported that honeypot telemetry from security firm Previdian logged a dozen unsuccessful exploitation attempts against decoy stores after Sept. 7, originating from addresses in China and Romania, suggesting the flaw spread to opportunistic scanning within days of Adobe's hotfix.
The fix, and why patching isn't the last step
Adobe distributes the hotfix as a Composer patch, VULN-39341-composer-patches.zip, from repo.magento.com, layered on top of the earlier APSB26-138 update. Adobe's guidance goes beyond installing the patch: merchants are told to rotate encryption keys and every credential that key may have protected, including admin passwords, API tokens, payment gateway credentials, SSH keys and third-party integration secrets, and to deactivate and regenerate REST, SOAP and GraphQL tokens.
That instruction matters because patching closes the hole without evicting anyone already inside it, the same gap that has complicated cleanup after other unauthenticated, pre-login flaws disclosed in 2026, including ConnectWise's ScreenConnect bug and a Chrome V8 zero-day exploited within days of disclosure. Sansec has not said how many stores remain compromised, or whether the China- and Romania-linked scanning activity has slowed since Adobe's patch went out.
| Detail | Value |
|---|---|
| CVE | CVE-2026-75650 |
| CVSS score | 10.0 |
| Affected versions | Commerce/Magento 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3 |
| First exploitation | Sept. 4, 2026, 22:20 UTC |
| Hotfix shipped | Sept. 7, 2026, 20:20 UTC |
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.