A critical zero-day vulnerability known as StyleSmuggler is being actively exploited in Magento Open Source and Adobe Commerce to remotely compromise servers hosting online stores.
The flaw requires no authentication and enables attackers to inject malicious PHP code into files generated by the platform. The injected code is then processed through Magento’s template system, allowing remote code execution. The attack chain can be triggered during the generation of the platform’s default transaction failure emails, and the victim does not need to open any message for the exploit to succeed.
Researchers have successfully reproduced the attack on clean installations of versions 2.4.7, 2.4.8, and 2.4.9. One of the earliest victims was running Magento 2.4.6-p15 with the July and August security updates applied, demonstrating that even fully patched systems remain exposed.
Following successful compromise, attackers deploy a Rust-based implant outside the store directory. The malware disguises itself as the legitimate process [kworker/u:8:0] and creates a cron job that restarts the implant every five minutes to maintain persistence.
Compromised servers grant attackers access to active sessions, stored credentials, and application data, while also allowing the deployment of additional payloads. To date, no confirmed cases of data exfiltration or payment card skimmers have been observed in the analyzed incidents.
As of September 6, Adobe had not published a CVE identifier, official patch, or specific mitigation for StyleSmuggler. The company’s next scheduled security update is planned for September 8, though it remains unconfirmed whether it will address this vulnerability.
