On 4 September 2026, attackers began actively exploiting a previously unknown vulnerability in Magento Open Source and Adobe Commerce. As Sansec's advisory published on 5 September states: "Sansec is publishing early because stores are being compromised right now."
The vulnerability, now designated CVE-2026-75650 and scored CVSS 10.0, is named StyleSmuggler. It allows unauthenticated remote code execution on every version of Adobe Commerce and Magento Open Source from 2.4.4 through 2.4.9 inclusive. Adobe published an emergency hotfix, APSB26-146, on 7 September. Apply it now.
What StyleSmuggler actually does
StyleSmuggler exploits Magento's email template system in two stages. As The Hacker News reported: "The flaw abuses Magento's template system through PHP code injection to generate a Payment Transaction Failed Reminder email, triggering code execution in the process."
The attack requires no authentication. It requires no user to click anything. No email needs to be opened or received for the attack to succeed. The injected code executes the moment Magento internally renders the failed-payment email template. Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and installs a persistent Rust-compiled backdoor and PHP web shell.
The C2 server disguises itself as a regular Network Time Protocol (NTP) server on port 123, making it difficult to distinguish from legitimate network traffic through simple firewall rules.
Why this is different from previous vulnerabilities
The finding that should concern every Magento merchant is this: as SecurityWeek confirmed, "the flaw works on Magento versions 2.4.7, 2.4.8 and 2.4.9, and has been exploited against deployments running the July and August 2026 patches."
The first confirmed victim was running 2.4.6-p15 with the July and August 2026 security patches fully applied. Fully patched stores were compromised.
This means that every defensive measure short of Adobe's specific APSB26-146 hotfix has been insufficient. WAF rules that were not updated to block StyleSmuggler-specific request patterns before the hotfix provided no protection.
The hotfix: what you need to do right now
Adobe published APSB26-146 on 7 September at 20:20 UTC with Priority Rating 1, its highest priority level. The fix ships as a hotfix applied via Composer patch, not as a full release.
Download VULN-39341-composer-patches.zip from repo.magento.com and apply it as a composer patch. Adobe tested the hotfix against the 2026-aug releases of Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.4 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3.
Confirm correct installation with:
vendor/bin/magento-patches -n status | grep "39341\|Status"
For merchants on versions older than 2.4.4, Scandiweb has backported the fix to 41 older releases from 2.2.0 up to 2.4.3-p3. As Sansec notes, these backported patches have not been reviewed by Sansec, so test thoroughly before deploying to production.
Detecting whether you have already been compromised
Because StyleSmuggler was actively exploiting stores for 72 hours before Adobe issued any patch, merchants who applied the hotfix immediately should still investigate whether their store was compromised during the exposure window.
As Decryption Digest's technical guide documents, the following commands help identify compromise indicators:
Scan for PHP files in the media directory:
find /pub/media -name '*.php' -type f
Check for recently modified PHP files across the webroot:
find . -name '*.php' -newer var/log/system.log -type f
Look for unexpected outbound connections on port 123 from the web server process:
netstat -anp | grep :123
Query the email_template database table for injected code:
sql
SELECT template_id, template_code, template_styles FROM email_template
WHERE template_styles LIKE '%eval%' OR template_styles LIKE '%base64%'
Sansec's eComscan tool provides StyleSmuggler-specific automated detection.
The broader pattern
StyleSmuggler is the third critical security incident affecting eCommerce platforms in the past six weeks. Adobe's APSB26-92 account takeover (CVSS 9.1) was patched on 11 August and confirmed to be under active exploitation. The Shopware Store API pre-authentication account takeover was disclosed by Sansec on 25 August. Now StyleSmuggler.
This is not a coincidence. Attackers are systematically targeting eCommerce platforms with increasing sophistication. A CVSS 10.0 zero-day that bypassed all existing security patches and compromised stores within hours of its first observed exploitation represents a step change in the threat level facing Magento merchants.
The merchants who will weather this incident cleanly are those who apply the hotfix immediately, scan for compromise indicators, and treat this as a catalyst to build the ongoing security monitoring capability that the current threat landscape demands.
Apply APSB26-146 now. Scan for compromise. Do not wait.
About On Tap
On Tap is a growth-focused eCommerce consultancy and Adobe Commerce partner helping mid-market and enterprise merchants maintain secure, patched, and monitored stores. From emergency hotfix deployment and compromise scanning to ongoing security monitoring and incident response planning, On Tap helps merchants ensure that security discipline keeps pace with an escalating threat environment.
If you need help applying the StyleSmuggler hotfix or assessing whether your store was compromised, get in touch today.
