StyleSmuggler: The Zero-Day Vulnerability in Magento 2

🇬🇧 This article is also available in Romanian. / 🇷🇴 Preferi să citești în română? [Click aici pentru versiunea în limba română].

A critical vulnerability named “StyleSmuggler” has been reported in the Magento and Adobe Commerce ecosystem. According to researchers at Sansec, the vulnerability is being actively exploited in real-world attacks and can allow an unauthenticated attacker to execute code remotely (Remote Code Execution) on the server that hosts the platform.

For an online store, the consequences can be particularly severe: from planting persistent unauthorized-access mechanisms and altering how the platform works, to the theft of sensitive data or the staging of further cyberattacks.

What is StyleSmuggler?

StyleSmuggler is a zero-day vulnerability. The term describes a newly discovered security issue for which no official fix is yet publicly available, or for which the time to react is extremely limited.

The attack abuses mechanisms in the Magento templating system to reach malicious code execution on the server. In the tests published by Sansec, the full attack chain was reproduced on clean installations of Magento Open Source, including versions 2.4.7, 2.4.8 and 2.4.9. It is essential to keep in mind that updates applied in the past do not automatically guarantee protection against a newly disclosed vulnerability.

According to Sansec, the attack works in two stages. First, malicious PHP code is smuggled in by abusing how the platform handles styles properties, bypassing its safeguards, sometimes through automatically generated failure reports or through files uploaded to the server. Magento then executes that code when it renders the emails for failed payments. In the attacks observed so far, the end result is a Rust-based backdoor that connects to command-and-control servers.

Which versions are affected, and is there a patch?

Beyond the versions mentioned above, Sansec notes that all current releases are affected, including 2.4.9. One compromised store was even running 2.4.6-p15 with the July and August 2026 patches already applied, a sign that until a dedicated patch ships, even the latest updates do not fully close this hole.

At the time of writing there is no official patch. Adobe has confirmed it is working on a fix, with no ETA, and its next scheduled security bulletin is 8 September 2026. Check the official Adobe security updates page for the latest status.

Why it matters for online store owners

A security incident does not just mean temporary downtime for your site. Depending on the level of access attackers obtain, the main risks include:

• Theft of card data and personal information: Injection of malicious scripts (skimmers) into the checkout page.
• Unauthorized database access: Compromise of order history, customer data and credentials.
• Installation of backdoors: Creation of hidden administrator accounts or covert access channels.
• Reputational damage and unexpected costs: Loss of customer trust and significant spending on remediation and investigation.

What should you do now? (Action plan)

Before any drastic intervention, we recommend a technical assessment carried out in a controlled way. Here are the priority steps:

1. Check your version and updates: Identify the exact Magento / Adobe Commerce version and the patch level applied.
2. Analyze logs and files: Review server logs, running processes and recently modified files for unusual activity.
3. Reduce the attack surface: Examine exposed endpoints and apply temporary mitigations where appropriate.
4. Apply the recommended temporary measure: According to Sansec, temporarily disabling GraphQL until the official patch is released reduces exposure. Keep in mind this can affect headless setups or applications that rely on the GraphQL API.
5. Follow the official channels: Monitor the Adobe page with security updates so you can apply official patches quickly.
6. Prioritize any signs of compromise: Isolate the system, preserve technical evidence and rotate credentials as part of a clear incident-response plan.

A warning sign, not an automatic confirmation

The fact that your store runs Magento or Adobe Commerce does not automatically mean it has been compromised. However, when a vulnerability is being actively exploited, the absence of visible signs is not a guarantee of safety. A non-intrusive check helps identify exposure without disrupting how the store operates.

Signs of compromise

If you want to check manually, some of the indicators reported by researchers include:

• Processes with names that mimic system processes, for example [kworker/u:8:0], fc-cache or chronyd.
• New, unexpected cron entries.
• Network connections to unknown IP addresses used as command-and-control servers.
• PHP files that appear in the media directories, where executable code should normally never exist.

The absence of these signs does not guarantee the store is clean, but the presence of any of them calls for an immediate investigation.

Protect your online store with CloudEBS

The StyleSmuggler vulnerability shows how important proactive e-commerce security monitoring is. Prevention and a fast response make the difference between a protected business and a costly security incident.

How the CloudEBS team can help: We run non-intrusive checks and dedicated security audits for Magento platforms, to detect risk exposure and to keep your hosting environment stable and secure.

Request an initial security assessment and make sure your store is protected!