Unpatched Magento zero-day exploited in the wild, no fix from Adobe yet

Attackers have been exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce since September 4, installing backdoors on online stores’ servers without any authentication required, Dutch e-commerce security firm Sansec disclosed Friday.

The flaw, dubbed StyleSmuggler by the researchers who found it, enables unauthenticated remote code execution — the most dangerous class of web vulnerability. As of September 6, Adobe has not published a patch, a CVE identifier, or even an advisory. The company’s next scheduled security release is September 8, but it is not confirmed whether that update will cover this bug. Sansec published its advisory early because, in the firm’s own words, “stores are being compromised right now.”

All current versions are vulnerable

Sansec confirmed it reproduced the full unauthenticated exploit chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. One confirmed victim was running version 2.4.6-p15 with all of Adobe’s July and August 2026 security patches applied — meaning even fully patched stores are at risk. Sansec has not confirmed whether Adobe Commerce on Cloud is equally affected.

How the attack works

StyleSmuggler operates in two stages. First, attackers inject malicious PHP code into a file that Magento writes automatically during failure-report generation. Then they trigger execution by initiating a standard Payment Transaction Failed Reminder email. Because the code runs during server-side email rendering — not inside any email client — no user needs to open anything for the attack to succeed. A successful exploitation installs a persistent backdoor on the server.

Indicators of compromise include a malicious background process disguised as [kworker/u:8:0] and unusual spikes in “Payment Transaction Failed Reminder” emails. Independent incident responder Disrex Group, which handled two compromised stores, published server log patterns and mitigation rules in an open GitHub repository.

What merchants should do now

Until Adobe releases a patch, Sansec advises merchants to temporarily disable GraphQL. This blocks the exploit path but will break headless and progressive web app storefronts that depend on the GraphQL API — most classic and Hyvä storefronts are unaffected. Merchants should also audit server logs immediately for the indicators above and scan for secondary backdoors using Sansec’s eComscan tool.

The scale of the campaign is not yet known. Sansec has not disclosed how many stores have been compromised. Adobe’s September 8 security bulletin may address the flaw — merchants should apply it the moment it drops, as reported by The Hacker News.