Threat actors are exploiting a newly found zero-day flaw in Magento Open Source and Adobe Commerce to install persistent backdoors and compromise online stores.
Dutch e-commerce security firm Sansec found the vulnerability, called “StyleSmuggler,” which lets threat actors run malicious code on compromised servers without needing verification. According to Sansec, it found active attacks starting on September 4,2026 and posted the information after discovering that online stores were already being targeted.
About the vulnerability
StyeSmuggler is a severe remote code execution (RCE) vulnerability impacting present Magento variants. According to Sansec, the flaw successfully reproduced the attack on Magento Open Source variants 2.4.7, 2.4.8 and 2.4.9. This includes the latest 2.4.9 release.
What can impacted merchants do?
For people who are not using Sansec Shield, they can temporarily stop Graphql until Adobe has issued an official patch. “The next Adobe security release is scheduled for Sept 8th, but it is yet unknown if that covers this bug,” Sansec said.
The flaw is notedly troubling as threat actors don’t require any password, admin account, or a username to exploit it. A successful compromise could give attackers the power to run code directly on the server hosting an online store.
Malicious code is injected into Magento's template system by StyleSmuggler. It can get around present safety precautions by utilizing the styles features. It operates in two phases:
- Create a failure report, for instance, to inject (poison) PHP code.
- Allow Magento to use a failed payment email to execute the poisoned code.
Threat actors exploit GraphQL and Magento’s template functionality to install malicious code, The attack can then prompt the installed code via Magento’s internal processes, in the end letting them download and run malware on the infected server.
Stores targeted even after security updates
The attack is not limited to stores running old software, which is a troubling finding.
“The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and security:patch-status clean,” Sansec said. In other words, even having the latest available security updates for the released could not stop the exploit of the new zero-day.
Another group, Disrex found the exploit, a Magento hosting and development company. “One of the Magento servers managed by Disrex was compromised only 50 minutes after the first confirmed StyleSmuggler attack worldwide,” it said.
What’s next?
No official patch has been released at the time of writing this article.
Read the original article: