StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
An attacker can break into your Magento or Adobe Commerce store without a password and run their own code. Attackers are already using this flaw to install backdoors and steal data.
- Report priority
- High
- Targets
- Retail
How it works
- Attackers send a special request to the store's payment email feature.
- The store's code then reads a hidden malicious code snippet from a CSS file.
- When the store sends a failed payment email, the attacker's code runs on your server.
- This lets them take full control of your store's computer.
What to do
Check if you use Magento or Adobe Commerce version 2.4.0 or earlier. Look in your admin panel under System > About or run php bin/magento --version in your store's folder. If the version is 2.4.0 or earlier, you are affected. If you see version 2.4.10 or newer, you are not affected yet.
Stop using Magento or Adobe Commerce until version 2.4.10 or a patch is released. Disable the GraphQL API in your admin panel under Stores > Configuration > Advanced > Advanced > Advanced > Web Services > GraphQL. Scan your server for unusual files or processes, especially ones named kworker, fc-cache, or chronyd. Contact your hosting provider or Magento support for help.
Technical details
Affected software: Retail
An attacker sends a fake payment request to a Magento store. The store's email system then loads a malicious CSS file from an attacker-controlled website. When the store sends a failed payment email, the attacker's code runs on the server, installing a backdoor that connects to a remote server.
A zero-day remote code execution (RCE) vulnerability, tracked as OTX-6a9ef14fbc62257cff38357b, affects all supported versions of Magento and Adobe Commerce, including 2.4.9. Attackers exploit this flaw by injecting malicious PHP code into Magento's template system via CSS styles, bypassing basic security checks. Once injected, the payload executes during failed payment email processing, granting full system control.
Active exploitation began on September 4, 2026, with threat actors deploying a Rust-based backdoor, disguised as system processes like kworker, fc-cache, or chronyd, to maintain persistence. The backdoor communicates with command-and-control servers using NTP-shaped UDP traffic to evade detection. A separate attacker group has also been observed deploying PHP web shells via the same vulnerability.
No official patch has been released as of this writing.