# Critical Unauthenticated Code Execution Flaw Affecting Magento and Adobe Commerce Platforms
**September 2026** — A newly discovered security vulnerability in Magento Open Source and Adobe Commerce is currently being actively exploited by attackers to achieve unauthenticated code execution on online store servers, according to reports from multiple cybersecurity researchers and e-commerce hosting providers.
## What Is the Vulnerability?
The flaw, tracked under the designation **StyleSmuggler** by the Dutch security firm that identified it, allows threat actors to run arbitrary malicious code on a Magento-powered server without needing valid login credentials. This means an attacker can compromise an online store remotely, install persistent backdoors, and maintain long-term access to the system.
The vulnerability affects all currently supported versions of the platform, including Magento Open Source 2.4.7, 2.4.8, and 2.4.9, as well as older patched releases. Researchers successfully reproduced the full attack chain on clean, unmodified installations, confirming the severity and broad scope of the issue.
## How Are Attackers Exploiting It?
The attack unfolds in a two-stage process that leverages legitimate Magento functionality in unintended ways:
1. **Initial Code Injection:** The attacker plants PHP code into a file that Magento itself generates during normal operations, such as when the platform creates failure reports or logs system events. The malicious payload is hidden within these routine files, making it difficult to detect through standard monitoring.
2. **Code Execution Trigger:** The attacker then tricks Magento into executing the injected code by leveraging the platform’s built-in “Payment Transaction Failed Reminder” email system. The malicious code runs while Magento processes the email template for rendering, meaning no user needs to open or interact with the email for the exploit to succeed. Notably, the attack can even work if email delivery itself fails.
Once the code executes, the attacker installs a persistent backdoor that disguises itself as a legitimate Linux kernel thread, ensuring it survives server reboots and remains hidden from casual inspection.
## Impact and Scope of Compromise
The vulnerability has already been used to breach multiple online stores. One hosting provider that manages Magento installations reported handling two confirmed compromises and a third attempted attack that was blocked before it succeeded. The attacks occurred within a narrow window of roughly eight hours, during which no defensive measures existed.
Affected stores experienced the following consequences:
– Installation of a persistent backdoor process disguised as a system thread
– Theft of Magento session data from internal Redis instances
– Injection of malicious cron entries that automatically restore the backdoor
– Potential access to customer session information and administrative credentials
Security researchers noted that in the cases they examined, there was no evidence of payment card skimmers, rogue administrator accounts, or direct database manipulation — but the potential for these outcomes remains significant given the level of access granted by the vulnerability.
## Current Status of the Patch
As of the latest available information, Adobe has not yet published an official advisory, assigned a CVE identifier, or released a patch or workaround for this vulnerability. The company’s security bulletin index shows no updates since mid-August 2026. Adobe’s next scheduled security release is expected within the coming days, but it remains unclear whether it will address this specific issue.
In the absence of an official fix, security researchers and hosting providers have been racing to publish interim mitigation strategies.
## Recommended Interim Mitigations
Until Adobe releases an official patch, the following measures are recommended for store administrators:
**Temporary GraphQL Disabling:**
Disabling GraphQL is the simplest immediate step for stores that do not rely on headless or progressive web app storefronts. Classic storefront designs and Hyvä-based themes typically do not require GraphQL, making this a low-impact mitigation for many merchants.
**Server-Level Hardening:**
Administrators can add PHP configuration restrictions that limit the damage an attacker can do even if they achieve code execution. Disabling the `proc_open` PHP function prevents the malware dropper from launching the persistent implant. Mounting temporary directories (`/tmp`, `/var/tmp`, `/dev/shm`) with the `noexec` flag ensures that any downloaded binary cannot execute, regardless of whether it reaches the server.
**Web Application Firewall Rules:**
Several security teams have published rules for Nginx and Apache web servers that block requests containing the specific parameters used in the exploit. These rules target the current campaign’s attack patterns but may not cover all possible exploitation methods.
**Dependency Injection Scanner Hardening:**
Unofficial patches have been developed that modify Magento’s code scanning components to prevent them from processing attacker-controlled input outside of command-line operations. These patches are available through community repositories and can be applied using Composer-based deployment tools.
## Detection and Incident Response
For stores that suspect they may already be compromised, researchers have published detailed indicators of compromise, including:
– Suspicious processes named after kernel threads but running under non-root user accounts
– Malicious binaries hidden in non-web-accessible directories within the site user’s home folder
– Cron entries pointing to unusual file paths that restart the malicious process every five minutes
– Unexpected surges in “Payment Transaction Failed Reminder” email notifications
Security scanning tools have been updated to detect known implant files and processes. Store operators who discover evidence of compromise are advised to preserve forensic evidence, remove malicious cron entries before terminating processes, avoid rebooting the server (which may destroy volatile artifacts), and immediately rotate all credentials including Magento admin passwords, encryption keys, and payment provider API keys.
## Frequently Asked Questions (FAQ)
**Q: Which versions of Magento and Adobe Commerce are affected?**
A: All currently supported versions appear to be vulnerable, including Magento Open Source 2.4.7, 2.4.8, and 2.4.9, as well as older patched releases. Adobe has not yet confirmed the full list of affected versions.
**Q: Do I need to be using Adobe Commerce (the paid version) to be affected?**
A: No. Confirmed compromises have been reported on Magento Open Source installations. Adobe Commerce and Adobe Commerce on Cloud have not been independently confirmed as affected, but given the nature of the vulnerability, they are presumed at risk.
**Q: What should I do right now?**
A: Disable GraphQL if your storefront does not require it, apply server-level PHP hardening measures, and monitor your systems for indicators of compromise. Contact your hosting provider for additional guidance and watch for official Adobe advisories and patches.
**Q: Is this vulnerability exploitable remotely over the internet?**
A: Yes. The attack requires no authentication whatsoever and can be executed entirely remotely by sending crafted HTTP requests to the targeted store.
**Q: My store is behind a web application firewall. Am I protected?**
A: Generic WAF rules may not catch this attack since it leverages legitimate Magento functionality. Specific rules targeting the exploit parameters have been published by security researchers and should be applied if available.
**Q: Has Adobe confirmed this vulnerability?**
A: As of the latest reports, Adobe has not yet published an official acknowledgment, CVE identifier, or patch. They are expected to address the issue in an upcoming security release.
**Q: How can I check if my store has been compromised?**
A: Look for the published indicators of compromise, including suspicious processes, unexpected cron entries, and unusual file locations. Running updated security scanning tools and reviewing access logs for indicators of exploitation can also help determine if your store has been affected.
## Conclusion
The StyleSmuggler vulnerability represents a serious and actively exploited threat to Magento and Adobe Commerce stores worldwide. Its ability to grant unauthenticated code execution, combined with the absence of an official patch from Adobe at the time of discovery, places a significant burden on store administrators to act quickly and implement available mitigations.
The incident highlights the importance of defense-in-depth strategies for e-commerce platforms, including server-level hardening, network segmentation, and real-time monitoring. Hosting providers have begun implementing precautionary measures across their environments, and the broader security community continues to develop tools and rules to help merchants detect and block exploitation attempts.
Store owners are strongly encouraged to stay vigilant, monitor their systems closely, and apply every available interim mitigation until Adobe releases an official fix. Given the speed and sophistication of the attacks observed so far, any delay in action could result in a compromise that goes undetected for extended periods.
Thank you for reading
