Online retailers using Magento Open Source and Adobe Commerce face an urgent threat from a newly discovered vulnerability. The zero-day exploit, identified by Dutch security firm Sansec as ‘StyleSmuggler’, is being leveraged by attackers to gain full control of e-commerce sites, with no official patch currently available.
Details of the StyleSmuggler Exploit
Sansec revealed the vulnerability on September 5, 2026, noting that it enables remote code execution without requiring authentication. The firm reported that attacks commenced the day before the disclosure. This exploit affects all current versions of Magento and Adobe Commerce, including the latest 2.4.9 release.
Alarmingly, even stores with up-to-date security patches are susceptible. Sansec confirmed this by reproducing the attack on installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9, showing that the flaw is not linked to outdated versions.
How the Attack Unfolds
The StyleSmuggler exploit unfolds in two stages, exploiting Magento’s template rendering and email systems. Initially, attackers insert malicious PHP code into files created during normal operations via a manipulated GraphQL request. This bypasses existing input sanitization measures.
In the second stage, the execution is triggered when Magento sends a standard ‘Payment Transaction Failed Reminder’ email. The malicious code is executed internally during this process, without any need for the email to be opened.
Defensive Measures and Recommendations
Detection is challenging as the malware disguises itself as a Linux kernel process, evading standard checks. Disrex Group, which conducted an independent analysis, found that the malware interacts with the store’s Redis instance, remaining hidden from network monitors.
Sansec suggests disabling GraphQL for those not using headless storefronts. Meanwhile, unofficial patches have been released by Disrex, ProxiBlue, and Graycore, though these are interim measures rather than permanent fixes. Server-level defenses, such as disabling PHP’s proc_open function, have also proven effective.
As store owners await Adobe’s next security release on September 8, they must rely on these temporary solutions to safeguard their platforms.
Stay informed and protect your online store from potential threats by implementing recommended security measures immediately.
