Magento StyleSmuggler Zero-Day Actively Exploited to Backdoor Stores

A new unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce is being actively exploited in the wild, Dutch e-commerce security firm Sansec disclosed on September 5. Tracked as StyleSmuggler, the flaw allows attackers to inject and execute malicious code on store servers without authentication, resulting in the deployment of a persistent PHP backdoor. Sansec reproduced the full unauthenticated exploit chain on clean installations of Magento 2.4.7, 2.4.8, and 2.4.9, and confirmed that the first observed victim was running version 2.4.6-p15 with Adobe's August 2026 security update applied. As of September 6, Adobe has not published a CVE, advisory, patch, or workaround, and the next scheduled Adobe Commerce security release is not expected until September 8.

Independent evidence of exploitation has emerged from Disrex Group, a Magento hosting provider that responded to two compromised stores and a third that was attacked but not breached. Store A, running Magento Open Source 2.4.8 and protected by Sansec Shield, was hit at 23:10 UTC on September 4, hours before Sansec's first blocking rules for this vulnerability went live. Store B, which was not a Shield customer, ran the outdated Magento 2.4.7-p2, a patch level dating to August 2024 that is eight security updates behind the current 2.4.7-p10. Both stores were hosted through Disrex's RexHosting service, underscoring the risk facing operators who lag behind on patching. As a stopgap measure, Sansec recommends that stores temporarily disable GraphQL, though Disrex notes that headless and progressive web app storefronts depend on GraphQL and cannot easily adopt this mitigation.

The campaign highlights the dangers of running unpatched e-commerce platforms and the speed at which zero-days are weaponized. Store operators should audit their Magento deployments immediately, apply the Adobe patch once it ships, and review server logs for indicators of compromise, including unexpected PHP files in writable directories. Security teams can validate external exposure with a port scanner, confirm certificates and TLS posture via the SSL/TLS checker, and identify any suspicious infrastructure linked to the store's domain using a WHOIS lookup. Until Adobe releases an official fix, defenders should treat any Magento-facing endpoint as a high-risk asset and monitor for backdoor activity.