Magento and Adobe Commerce: Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability

Critical Zero-Day Exploit in Magento & Adobe Commerce Under Active Attack

A severe zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited to gain full control of online stores running Magento Open Source and Adobe Commerce. Disclosed by Dutch security firm Sansec on September 5, 2026, the flaw allows unauthenticated attackers to execute remote code (RCE) on vulnerable systems, with attacks confirmed as early as September 4.

The vulnerability affects all current versions of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication to exploit. Even fully patched stores such as one running 2.4.6-p15 with all July and August 2026 security updates have been compromised, demonstrating the flaw’s severity.

Exploit Mechanics & Attack Chain

The attack unfolds in two stages, leveraging Magento’s template rendering and email systems:

1. Initial Exploitation – Attackers manipulate "styles" properties in a GraphQL request to inject malicious PHP code into a file Magento generates during normal operations (e.g., payment failure reports).
2. Trigger Execution – The exploit forces Magento to send a "Payment Transaction Failed Reminder" email, executing the poisoned code without requiring the email to be opened or received.

Once triggered, the malware deploys a Rust-based implant (1.9MB, compiled for x86-64 and ARM64) disguised as a Linux kernel thread ([kworker/u:8:0]) to evade detection. The implant persists via a cron job, restarts every five minutes, and avoids standard logging by writing directly to the crontab spool file.

Evasion & Detection Challenges

• The malware mimics legitimate kernel processes, making detection difficult.
• It modifies its in-memory binary, requiring defenders to hash both the file and live process.
• Some variants avoid external connections, instead querying the site’s Redis instance to steal session data, bypassing network monitoring.
• Sansec’s detection guidance suggests checking var/report, but compromised stores have also been found with infections in var/log/system.log.

Mitigation & Response

With no official patch from Adobe as of September 6, store owners are relying on temporary measures:

• Disabling GraphQL for stores not using headless or PWA frontends.
• Unofficial patches from Disrex, ProxiBlue, and Graycore, which harden specific Magento classes but do not fully resolve the vulnerability.
• Server-level protections, such as disabling proc_open and mounting temporary directories with noexec, to block payload execution.

Adobe’s next scheduled security release is September 8, but there is no confirmation that it will address this flaw. The company has yet to issue an advisory, assign a CVE, or provide an official workaround.

Source: https://cybersecuritynews.com/magento-and-adobe-commerce-0-day-rce/

Magento TPRM report: https://www.rankiteo.com/company/adobe-commerce

Adobe Commerce TPRM report: https://www.rankiteo.com/company/adobe-commerce

"id": "ado1788668623",
"linkid": "adobe-commerce",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Retail, E-commerce',
                        'location': 'Global',
                        'name': 'Magento Open Source',
                        'size': 'Large (widely used by businesses of all '
                                'sizes)',
                        'type': 'E-commerce Platform'},
                       {'industry': 'Retail, E-commerce',
                        'location': 'Global',
                        'name': 'Adobe Commerce',
                        'size': 'Large (widely used by businesses of all '
                                'sizes)',
                        'type': 'E-commerce Platform'}],
 'attack_vector': 'GraphQL request manipulation',
 'data_breach': {'data_exfiltration': 'Yes (via Redis instance queries)',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High (PII, payment information)',
                 'type_of_data_compromised': ['Session data',
                                              'Payment transaction details']},
 'date_detected': '2026-09-04',
 'date_publicly_disclosed': '2026-09-05',
 'description': 'A severe zero-day vulnerability, dubbed StyleSmuggler, is '
                'being actively exploited to gain full control of online '
                'stores running Magento Open Source and Adobe Commerce. The '
                'flaw allows unauthenticated attackers to execute remote code '
                '(RCE) on vulnerable systems, with attacks confirmed as early '
                'as September 4, 2026. The vulnerability affects all current '
                'versions of Magento and Adobe Commerce, including the latest '
                '2.4.9 release, and requires no authentication to exploit.',
 'impact': {'data_compromised': 'Session data, payment transaction details',
            'identity_theft_risk': 'High (session data and PII exposure)',
            'operational_impact': 'Full system compromise, unauthorized '
                                  'access, malware persistence',
            'payment_information_risk': 'High (payment transaction details)',
            'systems_affected': 'Magento Open Source, Adobe Commerce (all '
                                'versions including 2.4.9)'},
 'initial_access_broker': {'backdoors_established': 'Rust-based implant '
                                                    'disguised as kernel '
                                                    'thread',
                           'entry_point': 'GraphQL request manipulation'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': ['Official patch from Adobe '
                                                   '(pending)',
                                                   'Long-term hardening of '
                                                   'Magento classes'],
                            'root_causes': 'Unauthenticated RCE vulnerability '
                                           'in Magento/Adobe Commerce template '
                                           'rendering and email systems'},
 'recommendations': ['Disable GraphQL if not in use',
                     'Apply unofficial patches',
                     'Implement server-level protections',
                     'Monitor for unusual processes and file modifications'],
 'references': [{'date_accessed': '2026-09-05', 'source': 'Sansec'}],
 'response': {'containment_measures': ['Disabling GraphQL',
                                       'Unofficial patches from Disrex, '
                                       'ProxiBlue, and Graycore',
                                       'Disabling `proc_open`',
                                       'Mounting temporary directories with '
                                       '`noexec`'],
              'enhanced_monitoring': ['Checking `var/report` and '
                                      '`var/log/system.log` for infections'],
              'remediation_measures': ['Hardening specific Magento classes',
                                       'Server-level protections'],
              'third_party_assistance': 'Sansec (Dutch security firm)'},
 'title': 'Critical Zero-Day Exploit in Magento & Adobe Commerce Under Active '
          'Attack (StyleSmuggler)',
 'type': 'Zero-Day Exploit',
 'vulnerability_exploited': 'StyleSmuggler (unauthenticated RCE)'}