StyleSmuggler: Magento/Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

What it is

StyleSmuggler is CVE-2026-75650, an unauthenticated remote code execution 0-day in Magento Open Source and Adobe Commerce, disclosed by Sansec on September 5, 2026. Adobe rates it CVSS 10.0 (APSB26-146, priority 1). Exploitation began September 4 — three days before the hotfix existed — so a patched store can already be compromised.

How it works

The exploit abuses Magento's template styles properties to smuggle a gadget chain past existing safeguards. It runs in two stages:

1. Poison: POST PHP source to /paypal/transparent/response/ in the query string. The request throws No such entity with cartId = 0, and Magento writes the entire request — payload included — into var/report/<sha256>.
2. Execute: POST to /graphql with styles[first] pointing back at that report file; the rest of the styles parameters build a gadget chain (via Aws\S3\S3Client, Laminas\Loader\ClassMapAutoloader) that includes and evaluates it.

Execution is delivered through Magento rendering the standard "Payment Transaction Failed Reminder" email — no one needs to open it, and it works even when mail delivery fails. Later variants aim styles[first] at var/log/system.log and exception.log, so any file the web user can append to is a target. Moving sessions to Redis/DB does not help.

Affected

Every version from 2.4.4 through 2.4.9 (Adobe Commerce and Magento Open Source), plus Adobe Commerce B2B 1.3.3–1.5.3. Older in-branch versions are affected but the patch is unverified there. Sansec confirmed the full chain on clean 2.4.7/2.4.8/2.4.9; the first victim ran fully-patched 2.4.6-p15. Current patch level is no defence.

What to do

Apply Adobe's hotfix VULN-39341 (download VULN-39341-composer-patches.zip from repo.magento.com, apply as a composer patch), then verify:

vendor/bin/magento-patches -n status | grep "39341\|Status"

Patching does not clean an already-hit store. Scan for the implant and check for PHP files dropped under media:

crontab -l | grep -i gvfsd
ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd'
grep -ril 'x_trace_' var/report/
find -L pub/media -type f -name '*.php'

Then rotate the encryption key and every credential it protected (admin passwords, integration/OAuth tokens, payment-gateway keys, DB creds, SSH/deploy keys), at the source — rotating the key alone does not invalidate what an attacker already read. Out-of-support branches (2.2, 2.3, 2.4.0–2.4.3) get no Adobe patch; Scandiweb backported to 41 older releases, but Sansec has not reviewed them — test on staging.

Caveats

• The primary payload is a Rust backdoor beaconing as fake NTP (48-byte UDP to port 123) under process names [kworker/u:8:0], fc-cache, and chronyd. The chronyd variant can relaunch with no cron entry, so an empty crontab is not evidence of a clean host; it also self-installs but never beacons under a debugger (TracerPid check).
• At least three separate actors piggyback on the bug: an OAST-callback PHP web-shell dropper, a WraithC2/gs-netcat toolkit, and a cookie-triggered remote-file-include in vendor/magento/framework/App/View.php. Removing the background process alone is insufficient.
• Sansec Shield reportedly blocks known variants, but Sansec still recommends patching — payloads changed several times a day.