Magento StyleSmuggler Zero-Day CVE-2026-75650 Exploited Before Adobe's Hotfix

Adobe shipped an emergency hotfixHotfix🛡️An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required. on the evening of 7 September for CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce and Magento Open SourceOpen Source📖Software with publicly available source code that anyone can inspect, modify, and distribute. that Sansec has named StyleSmuggler. By the time the patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program. existed, the bug had been used in the wild for three days, and the first confirmed victim was a store with every July and August 2026 security patch installed. If you run any 2.4.x storefront, the patch state you had on Friday is irrelevant: apply the hotfix, then assume the encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. key is burned and rotate everything it protects.

What Happened

Sansec recorded the first confirmed attack late on 4 September, at roughly 22:20 UTC, and had reproduced the full chain on clean installations by the next day. Adobe Enterprise Support acknowledged on 7 September that it was working on a fix without giving a date, and then published the hotfix, tracked as VULN-39341, under security bulletin APSB26-146 at about 20:20 UTC the same day. The bulletin classifies the flaw as CWE-1336, improper neutralization of special elements used in a template engine, exploitable without authentication or user interaction, and states plainly that it has been exploited in the wild against Adobe Commerce merchants.

The exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. does not depend on an outdated install. Sansec's first victim was running 2.4.6-p15 with the July and August 2026 patches applied and a clean patch-status check. Sansec also reports blocking a probe against a 2.4.7-p10 store on 7 September, which puts the current patch level firmly in the "no defence" column. As of CISA's Known Exploited Vulnerabilities catalog version 2026.09.04, the CVE has not yet been added, so do not wait for a federal deadline to force the issue.

Who Is Affected

Adobe's knowledge base article lists the affected products as Adobe Commerce 2.4.4 through 2.4.9 on the August 2026 patch line and earlier, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Sansec's write-up extends the Open Source range down to 2.4.4; the difference is almost certainly Adobe listing only the Open Source lines it still supports, and in practice an older, unsupported store should be treated as vulnerable with no patch available.

The exposure is wide. BleepingComputer puts Magento's install base at more than 160,000 websites, including roughly 14,000 of the top one million sites. Every one of those stores that faces the internet, which is all of them by definition, had a pre-authentication code execution path open through the weekend.

Technical Analysis

StyleSmuggler is a two-stage attack against Magento's template rendering. Stage one poisons PHP code into data that the template system will later consume. Sansec's write-up describes doing this by deliberately generating a failure report, and its indicators reference a probe against the GraphQL endpoint with a crafted styles query parameter. The trick behind the name is that the injected payload rides in the styles properties of the template, which existing safeguards did not inspect.

Stage two is the part that makes this a genuine zero-click server-side compromise. The attacker triggers Magento's standard "Payment Transaction Failed Reminder" email, and the malicious code executes while Magento renders that email. No admin opens anything; the store's own cron and mail pipeline do the work. The concept explainer on how server-side template injection turns a rendering engine into a shell covers why template engines are such a rich source of this bug class.

The payload is more polished than the usual PHP web shellWeb Shell🛡️A malicious script placed in a web server's content directory that lets an attacker execute commands through HTTP requests. Web shells are a common persistence mechanism after remote code execution and are detected by looking for unexpected files in webapp directories.. Sansec describes a Rust-based Linux implant that installs itself as a background process disguised as a kernel worker threadThread🏠A low-power mesh networking protocol designed for IoT devices, used alongside Matter. named [kworker/u:8:0]. A second version seen on 6 September masquerades as fc-cache, copies itself into the user's fontconfig cache directory, and a third variant poses as chronyd. Persistence is a cron entry; Sansec lists schedules of every five minutes for a gvfsd-user variant, twice an hour for fc-cache, and twice an hour on a different offset for the chronyd variant. BleepingComputer summarises the persistence as a job repeating every 30 minutes.

Command-and-control is the interesting part. Early samples spoke TLS and WebSockets; the current implant disguises its beacons as NTP traffic on UDP port 123, sending nine 48-byte datagrams every 60 seconds. Sansec notes the packets are flagged as NTPv4 server mode, which a real client would never send, and that is the tell for anyone writing a detection. The C2 hostnames are typosquats of legitimate time services, including ntp.timesysnc.net, time.microsft.run and pool.microsft.studio, plus a direct IP on port 123 and another on 443. The beacon carries an agent ID, hostname, username, OS version, memory and disk usage, uptime, whether it has root, the implant version (2.1.4 and 2.1.5 have been seen) and the public IP. The implant also reads TracerPid from its own process status: if it is being traced, it installs but never beacons, which will frustrate anyone reproducing it in a debugger.

Sansec additionally observed an unrelated second attacker using the same flaw with a plain PHP dropper that writes web shells under the product image cache path, named to look like a sync script. Two independent groups exploiting the same zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. within days is a reliable indicator that the technique is circulating, not the property of one crew.

Immediate Actions

Apply VULN-39341 first. Adobe distributes it as a Composer patch archive from the Magento repository; the knowledge base article walks through the standard Composer patch procedure, and cloud customers can confirm it with the Quality Patches Tool status command. Before the hotfix existed, Sansec's interim advice, as reported by BleepingComputer, was to disable GraphQL; if you cannot patch within hours, that remains the stopgap.

Then treat the store as compromised until proven otherwise. Sansec's detection guidance is short and worth running verbatim on every 2.4.x host:

``` grep -ril 'x_trace_' var/report/ find pub/media -name '*.php' ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd' ```

A hit on the first command indicates a poisoned failure report, on the second a dropped web shell, on the third a running implant. Check crontabs for the schedules above, and check egress logs for UDP 123 to anything other than your configured time source, especially any flow that shows a client emitting server-mode packets.

Adobe's post-patch instructions go further than most vendors dare, and they are the correct call. Because a code execution primitive on a Magento host can read the application encryption key, and that key encrypts integration tokens, payment gateway credentials and system-privileged automation tokens, Adobe's knowledge base article tells merchants to rotate the encryption key and then work through the entire secret inventory: admin passwords, REST, SOAP and GraphQL tokens, OAuthOAuth🛡️An open standard authorization protocol that allows applications to access user resources without exposing passwords, using tokens instead of credentials. secrets, payment gateway credentials at the provider, database credentials, SSH and deploy keys, and third-party API keys, with maintenance mode and cron disabled during the sequence. Sansec's guidance matches: rotate the key and every credential it protected, at the source. The how-to on rotating every secret after an application server compromise turns that list into an ordered runbook you can hand to whoever is on call.

Long-Term Outlook

Three things stand out. First, this was a zero-day against a fully patched, widely deployed commercial platform, discovered by a third party from live attacks rather than by the vendor, with a roughly 70-hour gap between first exploitation and a fix. That gap is now normal, and the collapsing patch-to-exploit window is a planning input, not a surprise.

Second, the implant quality signals professional investment in Magento as a target. A Rust binary with process masqueradingProcess Masquerading🛡️A defensive-evasion technique in which malware names its running process to imitate a legitimate system process, such as a kernel worker thread or a font or time-sync daemon, so it blends into normal process listings. The StyleSmuggler implant used kworker, fc-cache and chronyd disguises., anti-debugging and protocol mimicry is not a script kiddie tool. The strategic piece on why self-hosted e-commerce platforms are a standing target explains the economics: a storefront holds payment flows and customer PII, and a compromised one pays out continuously.

Third, Adobe's rotation guidance sets a bar. Patching a pre-auth RCE and moving on leaves every secret the box held in the attacker's hands. Expect more vendors to be forced into the same honesty, and build the rotation muscle now, before the next one.

Sources

• https://sansec.io/research/stylesmuggler-0day
• https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
• https://www.bleepingcomputer.com/news/security/magento-stylesmuggler-zero-day-exploited-to-deploy-linux-backdoor/
• https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/
• https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
• https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/
• https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json