Magento Open Source and Adobe Commerce are facing an urgent crisis: a newly uncovered zero-day vulnerability—dubbed “StyleSmuggler”—is being actively exploited to gain full remote code execution over online stores. As of September 5, 2026, Dutch security firm Sansec has confirmed that live attacks are targeting vulnerable installations without any patch available yet.
What Makes StyleSmuggler So Dangerous
The flaw affects all supported versions of Magento and Adobe Commerce, including the most recent 2.4.9 release. No authentication is required for exploitation. Sansec successfully recreated the full exploit chain on clean setups running Magento versions 2.4.7 through 2.4.9. Even a store patched through July and August 2026 was compromised.
The attack operates in two phases. First, it abuses Magento’s template rendering and email systems. Attackers craft a malicious GraphQL request that manipulates “styles” attributes to embed PHP code in files Magento writes during normal operations—such as payment failure reports—thus bypassing sanitization.
In the second phase, the exploit triggers that code by forcing Magento to send its built-in “Payment Transaction Failed Reminder” email. The injection executes when Magento internally renders that email—even if it’s never delivered or opened.
Impact, Payload & Detection Challenges
Once executed, the attack leads to a PHP dropper cycling through several functions to spawn a persistent implant. Researchers found a Rust-based static binary (~1.9 MB), supporting both x86-64 and ARM64, masquerading as a Linux kernel thread named “[kworker/u:8:0]”. It’s set to relaunch every five minutes via a cron job entry, avoiding detection in standard logs.
The implant evades many usual security scans. The process runs under the web server’s own user account (not root), unlike real kernel threads, and has memory usage. Other adaptations include different hashes for on-disk files versus in-memory processes. In some compromised stores, the malware made no external connections—reading session data via Redis connections instead.
Detection must go beyond obvious signs. Administrators are warned to inspect both var/log/system.logand var/reportdirectories. Sansec’s initial detection guidance focused on var/report, but real compromises also appeared in var/log/system.log.
What Can Store Owners Do Right Now
Adobe has not yet issued a CVE, advisory, or patch for StyleSmuggler as of September 6. Their most recent security bulletin dates to August 11.
Until a proper patch is released—possibly in their next scheduled release around September 8—Sansec suggests disabling GraphQL for stores that do not depend on headless or Progressive Web App storefronts. Themes that stick to classic or Hyvä generally don’t need GraphQL, making this a risk-reduction move.
Temporary server hardening methods also show promise. These include disabling PHP’s proc_open, mounting temporary directories with noexec, and applying unofficial patches that guard specific Magento classes and template rendering email functions. Note that these are stopgap measures—not full fixes.
StyleSmuggler exposes a severe problem: even fully patched stores can be compromised. This broad vulnerability isn’t tied to an old release or flawed maintenance—it’s baked in recent Magento versions. Until Adobe rolls out an official fix, the risk remains high. Any store running GraphQL should treat this as an emergency.
