Magento Open Source / Adobe Commerce: unauthenticated RCE zero-day 'StyleSmuggler' actively exploited (CVE-2026-75650)
Severity: critical · Patch status: patched · Since 2026-09-05 · CVE-2026-75650
A zero-day dubbed StyleSmuggler gives unauthenticated attackers remote code execution against every current version of Magento Open Source and Adobe Commerce, including 2.4.9. The two-stage exploit injects PHP via style properties on a GraphQL request, writes the payload into a Magento-generated file, and executes it during server-side rendering of a Payment Transaction Failed Reminder email — no delivery needed. Confirmed intrusions installed a persistent Rust-based backdoor disguised as a kernel thread, exposing PII, payment data, admin credentials and enabling Magecart-style skimmers. Active exploitation began September 4, 2026; Sansec published research September 5. Adobe has since released urgent hotfixes tracked as CVE-2026-75650 (CVSS 10); Aikido also ships drop-in patches for several branches. Temporary mitigation: disable GraphQL, at the cost of headless/PWA storefronts.
What to do
- Apply Adobe's urgent hotfix for CVE-2026-75650 immediately, or Aikido's drop-in patched packages (2.3.1-p12007002+aikido, 2.4.7-p1012007002+aikido, 2.4.8-p512007002+aikido) if a version upgrade is not feasible
- If patching is delayed, temporarily disable GraphQL — the exploit's entry point — accepting that headless/PWA storefronts will go offline
- Hunt for compromise: look for Rust-based backdoors disguised as kernel threads, unexpected generated files, and signs of template-style injection
- Assume potential exposure of customer PII, payment transaction data and admin credentials; rotate admin credentials and review for skimmer injections
- Monitor for Magecart-style payment skimmers on storefronts and notify affected customers if breach is confirmed
Fixed versions
- Adobe urgent hotfixes for CVE-2026-75650; Aikido patches: 2.3.1-p12007002+aikido, 2.4.7-p1012007002+aikido, 2.4.8-p512007002+aikido
Sources
All live incidents on Threat Watch