StyleSmuggler: Magento 0-day is backdooring live stores
An unpatched Magento and Adobe Commerce zero-day has been exploited since September 4. Fully patched 2.4.x stores got backdoored anyway.
There is a working, unauthenticated remote code execution exploit against Magento and Adobe Commerce running in the wild right now, and there is no patch. Dutch e-commerce security firm Sansec published the advisory on September 5 and named the bug StyleSmuggler. The first confirmed attack landed the night before, at 22:20 UTC on September 4. Sansec detected the campaign twenty minutes later.
The detail that should stop you: the first victim was fully patched. It ran 2.4.6-p15 with the July and August 2026 security updates applied.
What actually happened
The attack runs in two stages. First, the attacker gets PHP into a file Magento writes on its own — failure reports are the observed path. Then they make Magento execute it by triggering the platform's standard "Payment Transaction Failed Reminder" email. The injected code runs while Magento renders that template internally. Nobody has to receive the email. Nobody has to open it. The exploit abuses styles properties to slip past the existing template sandbox, which is where the name comes from.
Sansec reproduced the full unauthenticated chain on clean installs of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. Every current version is affected, including the newest one.
As of today Adobe has published no advisory, no CVE identifier, no patch, and no workaround. Its Commerce security bulletin index still ends at the August 11 release. The next scheduled bulletin is September 8. Whether it covers this bug is unknown.
Why an unpatched Magento store is a business problem, not an IT ticket
A backdoor on a checkout server is not a defacement. It sits between your customer and their card, and the standard follow-on is a skimmer that survives your next deploy because it lives in the database or in a file your pipeline does not overwrite. You find out from your acquirer.
Until Adobe ships something, Sansec recommends temporarily disabling GraphQL. Community composer patches are circulating from Disrex, ProxiBlue, and Graycore. Harden the runtime while you are in there: disable proc_open in PHP, and mount /tmp, /var/tmp, and /dev/shm with noexec so a dropped payload cannot execute. Then scan for implants, because "we patched" and "we are clean" are different claims.
Key takeaways
- StyleSmuggler is an unauthenticated RCE in Magento and Adobe Commerce, exploited in the wild since September 4, 2026
- All current versions are affected, including 2.4.9 — the first known victim was fully patched at 2.4.6-p15
- The chain injects PHP, then triggers execution through the Payment Transaction Failed Reminder email render
- Adobe has issued no CVE, patch, or workaround; the next scheduled bulletin is September 8
- Interim moves: disable GraphQL, apply a community composer patch, disable
proc_open, mount temp dirsnoexec, then scan for backdoors
A checkout you cannot patch is a checkout you do not control. We build commerce systems with a deploy path you own, a real inventory of what is exposed, and monitoring that catches a skimmer before your processor does. Talk to us about your store or see what we build.
Sources: Sansec: StyleSmuggler, The Hacker News.
- #magento
- #adobe-commerce
- #zero-day
- #ecommerce
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Videowise turns UGC video into text LLMs can cite
Videowise launched AEO and YouTube GEO for Shopify brands, converting UGC video into structured Q&A on your own domain. The underlying pattern is free.
Read itClaude commerce agents ship — you still own the checkout
Anthropic released a Claude commerce agents blueprint with Shopify and Priceline live on it. No payment rails, no catalog, no ad layer. That's the whole point.
Read it