CRITICAL Vulnerabilities #Zero-Day #RCE

Zero-Day Exploitation: StyleSmuggler RCE in Magento, Adobe Commerce

2026-09-06 01:55 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: E-commerce stores running Magento Open Source and Adobe Commerce are at risk of unauthenticated remote code execution.
Affected systems: All current Magento Open Source versions, including 2.4.9, 2.4.8, 2.4.7, and 2.4.6-p15, are actively exploited.
Recommended remediation: Temporarily disable GraphQL to mitigate the active StyleSmuggler zero-day until a vendor patch is released.

An actively exploited zero-day vulnerability, dubbed ‘StyleSmuggler’ by security researchers, is compromising online stores running Magento Open Source and Adobe Commerce. This critical flaw allows unauthenticated attackers to execute arbitrary code on an affected store’s server, leading to the installation of persistent backdoors. The exploitation began as early as September 4, prompting an early disclosure by Dutch e-commerce security firm Sansec, who discovered the vulnerability. As of September 6, Adobe had not released an advisory, a CVE identifier, a patch, or a workaround, according to The Hacker News.

Technical Analysis of StyleSmuggler RCE

Understanding Magento Open Source Zero-Day Exploitation

The StyleSmuggler vulnerability is a serious unauthenticated remote code execution (RCE) flaw affecting Magento Open Source and Adobe Commerce installations. Sansec confirmed that the vulnerability enables attackers to run malicious code on a store’s server without requiring any authentication. This direct server compromise capability positions StyleSmuggler as an immediate and severe threat to e-commerce platforms. Sansec successfully reproduced the full unauthenticated exploitation chain on clean installations of Magento Open Source versions 2.4.7, 2.4.8, and 2.4.9. Furthermore, a victim store running 2.4.6-p15, which had Adobe’s latest July and August 2026 security updates, was also compromised, highlighting that existing patch levels do not protect against this zero-day.

Independent evidence of exploitation comes from Disrex Group, a Magento hosting and development company. Disrex responded to two compromised stores and a third that was attacked but not breached, confirming active exploitation in the wild. Both of the compromised stores they handled ran Magento Open Source, specifically versions 2.4.8 and 2.4.7-p2. A key finding from Disrex was that “patch status was irrelevant here,” emphasizing the zero-day nature of this threat.

Backdoor Characteristics

Successful exploitation of StyleSmuggler leads to the installation of a persistent backdoor on the compromised server. Sansec’s indicators describe the implant as a background process disguised under [kworker/u:8:0], a name typically associated with a Linux kernel thread. The binary is installed at ~/.local/share/.gvfsd/gvfsd-user within the site user’s home directory, rather than the web root, which can make detection more challenging for standard web-root scanners. A cron entry is added directly to the spool file under /var/spool/cron/crontabs/ to restart the implant every five minutes, circumventing system log entries for crontab replacements.

Disrex Group further described the binary as a stripped, statically linked Rust program, approximately 1.9 MB in size, built for x86-64 and arm64 architectures. Observations from compromised environments showed the implant maintaining numerous connections (up to 28) to the store’s Redis instance on port 6379, reading Magento’s session storage. Interestingly, some observed implants made no outbound connections, suggesting potential for internal reconnaissance or preparation for further on-site malicious activity without immediate data exfiltration, as no evidence of data exfiltration, rogue admin accounts, injected payment skimmers, or database backdoors was found on the contained stores.

Actionable Recommendations

Given the active Magento Open Source zero-day exploitation and the lack of an official patch, immediate action is required by administrators of Magento Open Source and Adobe Commerce platforms. The primary interim mitigation advice from Sansec for stores not running their Shield product is to temporarily disable GraphQL. Organizations are advised to immediately disable GraphQL Adobe Commerce installations, especially those that do not rely on it for headless or progressive web app storefronts.

StyleSmuggler RCE Mitigation Steps:

Disable GraphQL: This is the most critical immediate step. For classic or Hyvä storefronts, GraphQL is often not essential and can be disabled. However, note that headless and progressive web app storefronts do require GraphQL, posing a more significant challenge for those deployments.
Monitor for Backdoors: Actively scan for the described backdoor artifacts:
- Process names resembling [kworker/u:8:0].
- Files at ~/.local/share/.gvfsd/gvfsd-user.
- Unusual entries in /var/spool/cron/crontabs/.
Incident Response: Be prepared for incident response, including session invalidation and credential rotation, even if no immediate data exfiltration is detected. Disrex Group successfully contained breaches within hours by isolating affected accounts and rotating credentials.
Stay Informed: Monitor Adobe’s official security advisories for the release of a patch. Adobe’s next scheduled security release is September 8, though it is not yet confirmed if this release will address the StyleSmuggler vulnerability.

Implementing these interim recommendations for StyleSmuggler RCE mitigation is crucial to protect e-commerce operations from ongoing attacks while awaiting an official vendor fix.

#Zero-Day #RCE

X/Twitter LinkedIn Reddit HN

← Back to Articles