Adobe Commerce bug exploited before hotfix

Online stores running Adobe Commerce and Magento Open Source are under attack from a max-severity zero-day vulnerability. Security firm Sansec has identified active exploitation that allows unauthenticated attackers to execute code on vulnerable servers, and warns that patching alone may not be enough for stores that were already compromised.

The flaw, which Sansec calls StyleSmuggler due to the attack method abusing Magento's Style properties, has been assigned CVE-2026-75650. It carries a CVSS score of 10.0 and affects Magento and Adobe Commerce versions 2.4.4 through 2.4.9. Magento is the open-source edition, while Adobe Commerce is its commercial/enterprise counterpart. Adobe acquired Magento in 2018.

Attack begins with a failed payment email

StyleSmuggler's first step is to inject malicious PHP code into data that Magento itself writes out, such as a payment failure report. The attack deliberately triggers Magento's standard 'Payment Transaction Failed Reminder' email.

Attackers exploit Magento's template processing by passing specially crafted 'styles properties,' allowing the poisoned data—the injected PHP code—to execute on the server. The customer does not have to open the email; the code executes while Magento renders the message, meaning the attack can succeed even if delivery of the email subsequently fails.

Unexpected bursts of these failed-payment messages are a reason to investigate, though legitimate declined payments can generate the same notification, the researchers noted.

Backdoor runs as a Rust process

Once code execution is achieved, the attacker launches a small Rust-based backdoor as a background process. Sansec researchers described the implant: “When the attack succeeds, a backdoor background process is launched. This is a small Rust program that connects to the 99.84.67.186 C2 server and waits for commands.”

The backdoor has been seen adopting names such as “[kworker/u:8:0]” and “fc-cache,” which are non-suspicious to a human eye. It establishes command-and-control communication and uses persistence mechanisms, including cron jobs.

The fc-cache variant copied itself into the fontconfig cache directory and scheduled itself to restart twice an hour. Its C2 traffic was disguised as NTP traffic over UDP port 123, an attempt to blend malicious communications into routine system activity.

Exploitation timeline and affected versions

According to Sansec, exploitation began on September 4, with the first confirmed attack recorded at 22:20 UTC. The company reproduced the complete unauthenticated attack chain against clean Magento Open Source installations running versions 2.4.7, 2.4.8, and 2.4.9.

One victim was running version 2.4.6-p15 with both July and August security updates installed, highlighting that even fully patched stores were vulnerable.

Sansec has not yet seen evidence that the backdoor was weaponized after installation. However, the investigation revealed that another attacker was already exploiting the same StyleSmuggler access.

Second attacker drops a PHP web shell

On September 7, Sansec found a separate 485-byte PHP dropper that used the vulnerability to deploy a web shell inside Magento's product-image cache. The shell could execute PHP commands when supplied with the correct header, giving the second operator a foothold independent of the Rust implant.

This secondary access means that even if the Rust backdoor is removed, an attacker could retain control through the web shell. Sansec researchers pointed to unexpected PHP files under “pub/media” as a potential indicator of compromise.

Adobe releases emergency hotfix

Adobe has released an emergency hotfix, VULN-393411, for the vulnerability. The hotfix closes the vulnerability, but because attackers had three days to exploit the flaw before a fix arrived, Sansec warns that patching alone is not sufficient for stores that may have already been compromised.

“StyleSmuggler deliberately triggers Magento’s standard ‘Payment Transaction Failed Reminder’ email,” the researchers explained in their blog post. They emphasized that legitimate declined payments can also generate the same notification, making detection tricky.

Detection and response guidance

Sansec recommends checking for unexpected PHP files under “pub/media,” while also looking for known malicious processes, cron entries, and other indicators of compromise. Stores that suspect exposure should scan for implants and secondary backdoors, and rotate potentially compromised credentials and secrets.

The researchers also advised investigating unexpected bursts of 'Payment Transaction Failed Reminder' emails, as these may signal an attack attempt.

Why it matters

The active exploitation of a max-severity vulnerability in a widely used e-commerce platform raises the stakes for online store operators. Even with the hotfix, stores that were compromised before the fix may harbor backdoors that persist beyond patching. The discovery of a second attacker exploiting the same flaw suggests that threat actors are actively sharing or independently discovering this vulnerability, increasing the risk for unpatched stores.

For businesses, this incident underscores the importance of not only applying security patches promptly but also conducting thorough post-incident scans for implants and secondary backdoors. The fact that a fully patched version 2.4.6-p15 was compromised indicates that no store is immune if it had the vulnerability before patching. As attackers continue to exploit known vulnerabilities, proactive monitoring and rapid response are essential to protect customer data and maintain trust.