StyleSmuggler Hits Magento: Unpatched RCE, Stores Already Compromised

Sansec discovered and named StyleSmuggler on September 5, 2026, publishing an advisory ahead of its normal schedule because attacks were already underway. The vulnerability enables unauthenticated Remote Code Execution on all current versions of Magento Open Source and Adobe Commerce, including fully patched installations. As of September 6, 2026, Adobe has not released a patch, CVE, or workaround, leaving merchants without official defense.

How the Two-Stage Attack Works

The technical mechanism unfolds in two sequential phases. In the first, the attacker sends manipulated GraphQL requests that exploit the styles property to inject PHP code into system log or report files. Sansec documented injection via var/report/; Disrex Group independently verified that both stores it manages were compromised through var/log/system.log, an alternate path that would bypass controls targeting only the report directory.

In the second phase, the injected code executes when the server generates the administrative "Payment Transaction Failed Reminder" email. Server-side rendering of the template activates the payload without any human interaction or email opening by victims. This architecture makes the attack fully automatable and scalable.

The attack's recognition marker mutated within the first hours. Disrex observed headers in the form X-TRACE- followed by ten hexadecimal characters on the morning of September 5, and the same structure minus the word "TRACE" by that afternoon. The speed of adaptation suggests real-time testing and refinement.

The Rust Implant and Evasion Strategy

Post-compromise, the attacker deploys a statically linked Rust binary of approximately 1.9 MB, compiled for x86-64 and arm64 architectures. The process is masked with the name [kworker/u:8:0], mimicking the Linux kernel thread naming convention to evade visual detection in process lists.

Persistence is achieved via a cron entry written directly to /var/spool/cron/crontabs/. In one of the stores analyzed by Disrex, the same cron line was replicated 1,728 times. The binary is placed at ~/.local/share/.gvfsd/gvfsd-user, a path that mimics the GNOME virtual filesystem daemon.

A distinctive characteristic documented by Disrex concerns the implant's network behavior. On at least one store, the binary established no outbound connections—neither to download hosts nor to command-and-control infrastructure. Instead, it maintained 28 simultaneous connections to the local Redis instance on port 6379, reading Magento sessions directly. This operational pattern reduces the network-based detection surface and exploits the internal trust boundary of the application architecture.

"Patch Irrelevance" and Adobe's Silence

The most thoroughly documented case involves a merchant running Magento 2.4.6-p15 with Adobe's July and August 2026 security patches fully applied—the maximum update level available at the time of the attack. As Disrex told The Hacker News: "Patch status was irrelevant here, which is the part merchants most need to hear."

"Sansec is publishing early because stores are being compromised right now"

Sansec successfully reproduced the full attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. A second store managed by Disrex was eight security patch levels behind the current version (2.4.7-p2 versus 2.4.7-p10), confirming that neither a fully updated nor an outdated state is a discriminating factor for the vulnerability.

As of September 6, 2026, Adobe has not published an advisory, CVE, patch, or workaround. The next scheduled security release is set for September 8, 2026, with no confirmation it will include a fix for StyleSmuggler. The institutional silence contrasts with the community's fragmented response: Sansec released blocking rules for its Shield platform, while Disrex, ProxiBlue, and Graycore published unofficial hardening patches.

Why This Matters

The source does not specify official remedial measures or Adobe-validated workarounds. The dossier does not document the exact nature of data accessible via local Redis, nor does it confirm whether the implant possesses data exfiltration, payment skimming, or rogue admin account creation capabilities in all cases. Disrex detected no skimmers, exfiltration, or compromised admin accounts in the two stores it manages, but this data refers to a limited sample.

No infrastructure overlaps link the actor to known campaigns at this time. The attackers' origin, motive, and ultimate objective remain undetermined. Sansec has not declared a total number of compromised stores.

The vulnerability poses a structural problem for the Magento ecosystem: GraphQL is a mandatory architectural component for headless storefronts and Progressive Web Applications, which represent a growing share of modern implementations. The temporary GraphQL disablement recommended by Sansec for "non-headless/PWA" stores does not apply to this subset of installations, leaving a segment of merchants without a mitigation option that avoids functional degradation.

The time window between first observed exploitation and availability of any defenses was approximately eight hours. Disrex's documented containment times for the two compromised stores were approximately 11–14 hours from first contact. These intervals, measured on operators with active incident-response capabilities, indicate the event's speed relative to the sector's typical reactive capacity.

Observed Operational Variants

Forensic analysis conducted by Disrex on three stores—two compromised and one attacked but not breached—revealed significant differences from Sansec's initial model. Beyond the alternate injection path (system.log instead of report/), the implant's network behavior varies. The exclusive connection to local Redis instead of external C2 represents an operational pattern that challenges standard detection assumptions based on outbound traffic analysis.

The incident response repository published by Disrex on September 5, 2026—self-described as "written with AI assistance, during a live incident, in a few hours"—documents containment and forensic techniques applied in real time. The speed of publication reflects operational pressure and the absence of guidance from the official vendor.

The case of Store A, a Sansec Shield customer with the module installed, enabled, and licensed, breached at 23:10 UTC on September 4, illustrates the temporal limits of reactive defense: Sansec's first blocking rules took effect hours after the attack, not before.

The Current Picture for Merchants

As of September 6, 2026, Magento merchants operate in a condition of documented but unmitigable risk through official channels. The lack of a CVE, advisory, or Adobe communication leaves security teams without formal parameters for risk classification and compliance documentation. Community patches, while representing an operational alternative, do not carry the same level of testing and assurance as a vendor release.

The problem extends to managed hosting providers, which must activate proactive incident-response protocols on infrastructure they cannot protect via updates. The situation exposes the fragility of an e-commerce security model based solely on vendor patching timeliness, when attacker velocity outpaces the release cycle even during accelerated responsible disclosure phases.

Information is based on the cited source and current as of publication.

Sources

• https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html
• https://blog.rankiteo.com/ado1788668623-magento-adobe-commerce-vulnerability-september-2026/
• https://www.cryptika.com/hackers-actively-exploiting-magento-and-adobe-commerce-0-day-rce-vulnerability/
• https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html
• https://thehackernews.uk/trust-world-update-d
• https://thehackernews.uk/enterprise-ai-security-a