StyleSmuggler: Magento and Adobe Commerce CVSS 10.0 RCE Is Under Active Attack

Update, Sep 16: CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on September 8, and CrowdSec counted roughly 500 unique IPs and thousands of matching requests between September 9 and 13, with mass scanning still rising in mid-September. Adobe Commerce B2B 1.3.3 to 1.5.3 is also in scope, so apply VULN-39341 to every internet-facing instance, staging included. Until every store is patched, blocking obvious exploit patterns at the edge (PHP tags in the URL or Store header) can buy time, but it does not replace the hotfix.

What Changed

Sansec has disclosed an unauthenticated remote-code-execution chain in Magento and Adobe Commerce that it calls StyleSmuggler. Adobe tracks the issue as CVE-2026-75650, rates it CVSS 10.0, and published emergency bulletin APSB26-146 on September 7 at about 20:20 UTC. Adobe’s hotfix is VULN-39341, delivered as a Composer patch rather than a normal product release.

The first confirmed exploitation was on September 4. That timing matters: merchants had stores running current security updates and still had a three-day exposure window before the hotfix appeared. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations, and says the affected range covers Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9, including patched builds. A clean security:patch-status result is not evidence that this issue was covered.

The exploit abuses the template system through styles/template injection. The attacker first poisons PHP that Magento will later render. A failed-payment email path then causes Magento to execute the injected code. The email does not need to reach a customer; execution occurs while Magento renders the message, and delivery can fail without preventing the server-side code path.

Sansec observed a small Rust backdoor launched under a name such as [kworker/u:8:0], then newer variants using fc-cache and chronyd. The implant has used WebSocket/TLS C2 and newer builds use NTP-shaped UDP traffic on port 123, a deliberate attempt to blend into time synchronization. One observed build resolves domains resembling NTP infrastructure and sends packets that look like NTP replies while carrying data about the host and implant. Persistence has included cron entries and hidden files under locations such as ~/.cache/fontconfig/, /tmp/, and ~/.local/share/.

There is a second investigation track as well. Sansec found a different actor using the same initial access to place a PHP webshell under pub/media, including product-image cache paths. That is why removing the Rust process is not a complete cleanup. One Magento store can carry more than one post-exploitation artifact.

Why This Matters Operationally

This is an e-commerce incident, not just a patching task. The Magento process can often reach payment integrations, customer data, order records, deployment credentials, databases, and third-party extension APIs. Adobe specifically recommends rotating the Magento encryption key and every credential protected by it, including admin passwords, REST/SOAP/GraphQL integration tokens, OAuth secrets, payment-gateway credentials, database credentials, SSH/deploy keys, and extension API keys. Rotate those at their source; changing a value only inside Magento does not invalidate a copy an attacker already read.

The affected population includes merchants that did what routine maintenance told them to do. The first known victim was reported on a current patched build, and Sansec says even recent -p levels did not stop the probe. That changes the question from “Did we install the August patch?” to “Can we prove this store was not executed against between September 4 and the hotfix?”

The backdoor’s process names are chosen to pass a quick process review. Its NTP-shaped beacon is also a useful reminder that an allowed protocol and port do not establish legitimacy. A time-sync exception that ignores process identity, destination, packet behavior, or host context can hide a second-stage channel.

Patching is necessary but not sufficient. A store exploited before September 7 may still contain a cron persistence mechanism, a renamed binary, a PHP shell, stolen credentials, or an altered extension. Treat the hotfix as the start of response: preserve evidence, scan the application and host, review outbound traffic, and rotate secrets after you understand what the process could access.

What Defenders Should Verify First

• Confirm the hotfix, not just the product version. Apply Adobe’s VULN-39341 patch from the official Adobe/Magento distribution path. Confirm the result with vendor/bin/magento-patches -n status and retain the deployment output. Record the exact Commerce/Magento and B2B versions in scope.
• Establish the exposure window. Preserve web, PHP-FPM, application, mail, WAF, DNS, and egress logs covering September 4 through patching. Search for unusual styles parameters, suspicious POST /graphql activity, failed-payment email bursts, and requests that do not fit normal checkout behavior.
• Hunt the host, not only the application. Review process listings, parent processes, systemd state, user and root crontabs, and the cron spool itself. Look for kworker/u:8:0, fc-cache, or chronyd running from an unexpected path, especially under /tmp, .cache, or .local/share.
• Check the filesystem for persistence and webshells. Inspect the temporary paths and hidden directories reported by Sansec. Enumerate PHP files beneath pub/media, including product cache directories, and compare them with a known-good deployment. Do not assume a 404 response means a file is harmless; the observed shell returned 404 unless a special header was supplied.
• Review egress at the process level. Investigate unexpected UDP/123 traffic, repeated short bursts, NTP-looking domains, and connections to Sansec’s reported indicators. A legitimate chronyd should be validated by its path, package provenance, parent, arguments, and packet behavior—not its name alone.
• Rotate secrets in an ordered way. After collecting evidence, rotate the encryption key and all dependent credentials at their issuing systems. Revoke sessions and tokens, replace payment and cloud keys, and review deploy keys and extension integrations. Check access logs for use of those secrets before and after rotation.
• Rebuild when integrity is uncertain. If a backdoor, unauthorized PHP, modified extension, or unexplained credential use is found, isolate the host and rebuild from trusted artifacts. Removing one binary while leaving the application and webroot unverified leaves the attacker’s access path unresolved.

Source Context

• Sansec: StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
• BleepingComputer: Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
• Adobe Security Bulletin: APSB26-146; emergency hotfix VULN-39341 (September 7, 2026)

The operational conclusion is narrow: install VULN-39341, then prove whether the store was touched. A patched Magento store is not automatically a clean Magento store.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].