Attackers are actively exploiting a critical zero‑day vulnerability in Adobe Commerce and Magento Open Source, tracked as CVE‑2026‑75650 (CVSS 10.0). The flaw, nicknamed StyleSmuggler, allows unauthenticated remote code execution and the deployment of a stealthy Rust‑based backdoor on compromised stores.
What Is the Vulnerability?
The bug abuses Magento’s template engine by injecting malicious PHP code through the “styles” property of a crafted GraphQL request. When Magento processes a failed‑payment email, the injected code executes, giving the attacker full control of the server. The vulnerability affects all supported versions (2.4.4‑2.4.9) of both Magento Open Source and Adobe Commerce.
Impact and Exploitation
Since September 4 2026, multiple e‑commerce sites have been breached. Researchers observed a Rust backdoor (~1.9 MB) that connects to a C2 server and a secondary PHP web‑shell. Victims include stores running the latest August 2026 patches, proving that patching alone is insufficient.
Key findings from the field:
- Unauthenticated attackers can execute arbitrary code without any user interaction.
- The backdoor masquerades as a Linux kernel thread
[kworker/u:8:0]and persists via cron jobs. - Adobe issued an emergency hotfix (VULN‑39341) on September 8, but the exploit was already in the wild for several days.
Mitigation Steps
Adobe recommends applying the emergency hotfix immediately and rotating all encryption keys and credentials. Additionally, security firms suggest temporarily disabling GraphQL and scanning for the “styles” injection pattern. The Hacker News and SecurityWeek provide detailed hardening guidance.