StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Published September 7, 2026

A newly discovered flaw in Magento and Adobe Commerce lets attackers break into online stores without a password. They inject malicious code into the store's design files, then run their own programs on your server.

Report priority
High

How it works

  • Attackers send a specially crafted request to the Magento store's design system.
  • This request tricks the store into writing malicious code into its own template files, files that control how the store looks.
  • Once the code is hidden there, the attacker can make the store run their own programs on your server.
  • This works even if the store has recent security updates, because the flaw hides in the design system rather than the main security patches.

What to do

Check if you run Magento or Adobe Commerce version 2.4.6-p15 or newer. Go to your Magento Admin panel, click System > Status, and look for the Magento version number. If it's 2.4.6-p15 or higher, your store may still be vulnerable. Also, check if your store was recently hacked by looking for unusual activity in your server logs or unexpected files in your store's template folders (like app/design/frontend/).

Sansec is working on a fix, but for now, disable the Magento template system as a temporary stopgap. Contact your Magento hosting provider or developer to apply Sansec's emergency mitigation steps. Monitor your store's logs for suspicious activity. If you suspect an attack, restore your store from a clean backup and change all passwords immediately. For now, check Sansec's official advisory for updates: Sansec StyleSmuggler Advisory.

Technical details

An attacker sends a fake request to a Magento store's design settings, forcing the store to save malicious code into its template files. When visitors load the store, the hidden code runs on the server, letting the attacker take control of the store's backend.

A critical zero-day vulnerability, dubbed StyleSmuggler, affects Magento Open Source versions 2.4.7, 2.4.8, and 2.4.9, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable stores. The flaw was first observed in active attacks on September 4, 2026, and researchers at Sansec confirmed it bypasses existing safeguards by injecting malicious PHP into Magento's template system. The attack chain abuses the payment transaction failure email feature, even if email delivery fails, to trigger code execution, making it stealthy and difficult to detect.

The vulnerability does not require user interaction (e.g., clicking links or opening attachments) and can compromise stores that appear fully patched, as demonstrated on a 2.4.6-p15 instance with July and August 2026 patches applied. Attackers can use this to install backdoors or maintain persistence. No CVE ID or CVSS score has been assigned.

References

View Original Source