StyleSmuggler: Adobe Commerce and Magento Zero-Day Exploited
An unauthenticated template-engine injection flaw in Magento and Adobe Commerce let attackers achieve remote code execution for three days before an emergency hotfix landed.
First Seen: September 4, 2026
Affected Products: Adobe Commerce and Magento Open Source, Adobe Commerce on Cloud, Adobe Commerce B2B
Impact: StyleSmuggler, tracked as CVE-2026-75650 (CVSS 10.0), is a template-engine injection flaw in Magento Open Source and Adobe Commerce, exploited in the wild since 4 September 2026, that lets unauthenticated attackers achieve remote code execution by smuggling PHP into a failure report and forcing Magento to execute it while rendering a failed-payment email. Every release from 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 through 1.5.3 is affected, and fully patched stores were compromised for three days before Adobe released an emergency hotfix on 7 September. Successful attacks install a cron-persisted Rust implant disguised as a kernel thread outside the webroot that evades conventional scanners and reads session data from Redis, so affected organizations must apply the hotfix immediately, hunt for compromise since patching does not remove an existing implant, and rotate the encryption key and every credential it protects.
CVE
| CVE | Name | Affected Product | Zero-Day | CISA KEV | Patch |
|---|---|---|---|---|---|
CVE-2026-75650 | StyleSmuggler (Adobe Commerce and Magento Open Source Remote Code Execution Vulnerability) | Adobe Commerce and Magento Open Source, Adobe Commerce B2B | Yes | Yes | Yes |
Vulnerability Details
CVE-2026-75650 and rated CVSS 10.0, it was addressed by Adobe through an emergency hotfix on 7 September 2026, with exploitation in the wild confirmed by the vendor. Every release from 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 through 1.5.3 is affected, and a fully patched 2.4.6-p15 installation carrying the August 2026 update was among the first confirmed victims, so patch level prior to the hotfix offers no protection.var/report/ marked with an X_TRACE_ identifier, or alternatively a file uploaded through Magento’s product custom options. A crafted template directive abusing style properties then loads that poisoned file through an internal code path intended only for command-line build tasks. Triggering the platform’s standard “Payment Transaction Failed Reminder” email executes the payload during rendering, whether or not the message is delivered, giving the attacker code execution as the Magento filesystem user.[kworker/u:8:0] under a non-root user, installs at ~/.local/share/.gvfsd/gvfsd-user outside the webroot, persists through a cron entry relaunched every five minutes and re-written within a second if removed, beacons to a hardcoded command-and-control server, and on at least one host read session data from local Redis with no outbound traffic.X_TRACE_ markers in var/report/. Where the hotfix cannot be applied at once, temporarily disabling GraphQL and restricting PHP process-execution functions reduce exposure, and in all cases the encryption key and every credential it protects should be rotated.Vulnerability
| CVE ID | Affected Products | Affected CPE | CWE ID |
|---|---|---|---|
CVE-2026-75650 | Adobe Commerce and Magento Open Source 2.4.4 - 2.4.9 (2026-aug and earlier), Adobe Commerce on Cloud, Adobe Commerce B2B 1.3.3 - 1.5.3 | cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* | CWE-1336 |
Recommendations
Download VULN-39341-composer-patches.zip from repo.magento.com, apply it as a Composer patch, and confirm with vendor/bin/magento-patches -n status | grep "39341\|Status". The hotfix is verified only against 2026-aug patch levels of 2.4.4–2.4.9 and B2B 1.3.3–1.5.3; bring older builds current first. Patching closes the vulnerability but does not clean an existing compromise, so complete the hunt.
Treat every Magento or Adobe Commerce server that was internet-facing on or after September 4, 2026 as potentially compromised irrespective of patch level. Run read-only checks as the Magento filesystem user: list non-root processes whose name begins with a bracket and hold real resident memory; inspect crontab entries for gvfsd or .kw_; look for ~/.local/share/.gvfsd/, /tmp/.kw_ and /tmp/.gvfsd- files; grep var/report/ and var/log/ for X_TRACE_ or PHP opening tags; scan the entire user home directory, not just the document root.
Do not reboot, delete the binary, or run composer install first, as each destroys evidence while leaving persistence intact. Confirm the match, preserve a hash of the running process from /proc/<pid>/exe, remove the cron entry before stopping the process, then remove known files, and hunt for secondary persistence in systemd timers, cron, shell profiles, SSH keys, and admin accounts.
Investigate any unexpected burst of “Payment Transaction Failed Reminder” emails, and treat unresolved template variables, a .invalid customer domain, or a zero order total as exploitation exhaust. A TypeError from array_merge() in system.log immediately after an include indicates the payload already executed.
Because the implant read Magento session storage from Redis, invalidate all sessions and flush session storage, then rotate the crypt/key in app/etc/env.php, every administrator password, payment-provider API key, and database credential. Adobe’s rotation guidance additionally covers REST, SOAP and GraphQL tokens, OAuth secrets, and SSH/deploy keys.
Potential MITRE ATT&CK TTPs
Indicators of Compromise (IOCs)
| Type | Value |
|---|---|
| SHA256 | e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7,b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420,4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e,d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82,1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d,8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef,251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220,d61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e |
| Domain | 247[.]cdnflare[.]xyz,windwsecurity[.]run,ntp[.]timesysnc[.]net,time[.]microsft[.]run,pool[.]microsft[.]studio,ntp[.]timesync[.]to,ntp[.]synctime[.]to,ntp[.]syncstime[.]to,457cfa2fb7p5[.]daf892t5qau4og8pi4cghbc6fhm1dim3u[.]oast[.]site |
| URL | hxxps[:]//www[.]incofar[.]it/js/jquery/plugins/ajaxfileupload/mag[.]txt |
| IPv4:Port | 99[.]84[.]67[.]186[:]443, 185[.]157[.]160[.]251[:]123 |
| IPv4 | 209[.]141[.]43[.]95, 88[.]216[.]72[.]181, 182[.]182[.]152[.]48, 76[.]31[.]99[.]207, 209[.]73[.]130[.]148, 77[.]239[.]124[.]107, 5[.]181[.]86[.]133, 91[.]238[.]181[.]19 |
| IPv6 | 2a06[:]98c1[:]3120[::]2, 2a06[:]98c1[:]3121[::]2 |
| File Path / Process | gvfsd-user,fc-cache,chronyd,kworker-linux-x64,kworker-linux-arm64,~/.local/share/.gvfsd/gvfsd-user,~/.local/share/.gvfsd/.gvfsd_<8hex>.lock,~/.cache/fontconfig/fc-cache,/tmp/.kw_<random><random>,/tmp/.cache_<random><random>,/tmp/.fc-<8hex>/fc-cache,pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php,var/report/,var/log/system.log |
| Cron Entry | */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user*/5 * * * * exec /tmp/.kw_<random><random> |
| HTTP Request | POST /graphql?styles[...]=POST /paypal/transparent/response/?<?=eval(base64_decode('...X-TRACE-<10hex>, X-<12hex> |
| User-Agent | python-requests 2.15.0, python-requests/2.32.4, Mozilla/5.0 |
Patch Links
References
- sansec.io — StyleSmuggler research
- disrex.nl — StyleSmuggler Magento zero-day
- helpx.adobe.com — APSB26-146
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)