Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

Published September 7, 2026

Attackers are breaking into Magento and Adobe Commerce stores without a password and installing malware that can receive remote commands. Adobe now provides a hotfix, but stores also need a compromise check and the vendor's credential-rotation procedure.

Report priority
High
Targets
Magento Open Source+1 more

How it works

  • An attacker sends requests without logging in and uses styling properties to slip malicious code into data used by Magento's templates.
  • The attacker then triggers a failed-payment email.
  • Magento runs the planted code on the server while preparing that email, before anyone could open it.
  • The code can install malware that gives the attacker remote access.
  • Sansec reports successful attacks, but hasn't published a complete breakdown of the exploit chain.

What to do

Ask your store developer or hosting provider to confirm the product, exact version and whether VULN-39341 is applied. An August 2026 patch level alone isn't enough. For Adobe Commerce on Cloud with the Quality Patches Tool installed, Adobe documents running vendor/bin/magento-patches -n status | grep "39341\|Status" from the Commerce project directory. Look for VULN-39341 with status Applied. Missing output doesn't establish a fix. On other installations, ask the maintainer for installation evidence using Adobe's instructions. Have the host or security team compare the server with Sansec's current compromise indicators. Check executable paths and scheduled jobs, including cron spool files, and unexpected PHP files under pub/media. Names such as chronyd can belong to legitimate programs. An empty crontab doesn't prove the host is clean. Unexpected failed-payment emails are a reason to investigate, but legitimate declined payments can also generate them. Patch status can't establish whether the store was compromised earlier.

Have the store maintainer apply VULN-39341 using Adobe's hotfix instructions and confirm installation. Adobe tested the hotfix only on the listed 2026-aug builds, so owners of older builds or unlisted branches should ask Adobe or their provider for a supported installation path. Follow Adobe's post-patch procedure, including rotating the encryption key and all listed administrator, integration, payment, database, deployment, service-account and extension credentials at their issuing services. Have the host or security team investigate Sansec's indicators, because applying the hotfix doesn't show whether the store was compromised earlier or remove malware already present.

Technical details

Affected software: Magento Open Source, Adobe Commerce

Sansec reports StyleSmuggler attacks beginning September 4, 2026 and reproduced the full chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9 installations. Its first reported victim used 2.4.6-p15 with the July and August patches. Sansec observed a failed attempt involving session storage followed eight seconds later by a successful attempt using a custom-options upload, so moving sessions to Redis or a database isn't sufficient protection.

Observed payloads include a Rust backdoor disguised as system processes and, in a separate attacker's activity, a PHP web shell under the product-image cache. Persistence varied between hosts, and one malware build could relaunch without a cron entry. Adobe confirms exploitation of CVE-2026-75650 and released hotfix VULN-39341 on September 7.

References

View Original Source