Adobe Commerce and Magento stores hacked by StyleSmuggler backdoor
Adobe Commerce and Magento stores are being hacked by a new backdoor called StyleSmuggler. Attackers send malicious code to your store's server, then trick it into running that code when sending payment failure emails.
- Report priority
- High
- Targets
- Adobe Commerce+1 more
How it works
- Attackers send a malicious PHP file to your Magento or Adobe Commerce store.
- The store saves this file as part of its normal logs or error reports.
- Later, when the store sends a payment failure email, it runs the attacker's code.
- This lets the attacker install a hidden backdoor that keeps running even after you fix the issue.
What to do
Check if you run Adobe Commerce or Magento Open Source. If you see suspicious PHP files in your store's logs or error reports, ask them if your store was compromised.
Stop using your store immediately. Do not send payment failure emails or access the admin panel. Contact Adobe support or your hosting provider for help. Wait for an official patch from Adobe, which may take days or weeks.
Technical details
Affected software: Adobe Commerce, Magento Open Source
An attacker sends a fake payment failure email to a Magento store. The store's system logs save the attacker's malicious PHP code. When the store sends real payment failure emails, it runs the attacker's code, installing a backdoor that lets the attacker control the store.
A critical unauthenticated remote code execution (RCE) vulnerability, dubbed StyleSmuggler, affects Magento Open Source versions 2.4.7, 2.4.8, and 2.4.9. Attackers exploit the flaw by injecting malicious PHP code into system-generated files (e.g., error logs or transaction reports) and triggering execution via Magento's automated "Payment Transaction Failed Reminder" email. No authentication is required, and the attack succeeds even if the email fails to send, resulting in persistent backdoor installation and full server compromise.
Researchers at Sansec discovered the vulnerability on September 5, 2026, but Adobe has not yet assigned a CVE ID, released a patch, or confirmed affected Adobe Commerce versions. The exploit chain remains undisclosed, and no CVSS score has been assigned. All current Magento Open Source versions are vulnerable, with no patch available as of September 7, 2026.