On 4 September 2026 at 22:20 UTC, an unauthenticated request began landing on Magento and Adobe Commerce storefronts and walking straight to remote code execution. No login. No admin session. No plugin. The flaw, tracked as CVE-2026-75650 and named StyleSmuggler, carries a CVSS of 10.0, and it was exploited in the wild for roughly three days before Adobe shipped an emergency hotfix. This is a short advisory: what the vulnerability is, how the intrusion behaves once it lands, what to look for, and what to do first.<\/p>\n\n\n\n
StyleSmuggler is an unauthenticated remote code execution flaw in the Magento and Adobe Commerce template pipeline, classified as improper neutralisation of special elements in a template engine (CWE-1336). It reaches every supported branch: Magento Open Source 2.4.4 through 2.4.9, Adobe Commerce and Adobe Commerce on Cloud through 2.4.9-2026-aug, and Adobe Commerce B2B through 1.5.3-2026-aug. Adobe released the fix out of band as APSB26-146, delivered as the VULN-39341 Composer hotfix rather than a minor version bump. It was added to the CISA Known Exploited Vulnerabilities catalogue on 8 September 2026.<\/p>\n\n\n\n
The attack is two moves, and neither one looks like an exploit on its own. In the first move the threat actor abuses the template system’s handling of The second move triggers Magento’s built-in Payment Transaction Failed Reminder email. Rendering that template pulls the poisoned file through code paths that exist to serve the command-line dependency-injection compiler, and the smuggled PHP runs on the server. Execution happens during template rendering, so the email never has to be delivered for the code to fire. The elegance, from the attacker’s side, is that the dangerous step is the shop performing its own routine housekeeping on a file the shop itself created.<\/p>\n\n\n\n Confidence.<\/strong> The version range, CVSS and hotfix identifiers are confirmed by Adobe’s advisory. The exact injection parameter (the Code execution is the door. The payload behind it is a compiled implant: a stripped, statically linked binary of roughly 1.9 to 2.2 MB, built for both x86-64 and ARM64, so it runs on the full spread of hosting hardware without a dependency to satisfy. The sample listed in the indicators below is the Persistence is a cron job, but not an ordinary one. The implant writes directly to the cron spool file rather than going through the normal The implant does not hide from process listings, it blends into them. Early samples presented as The command-and-control channel followed the same instinct and then went quieter. Early variants spoke TLS over WebSocket to port 443, indistinguishable at a glance from ordinary HTTPS. Newer ones drop the connection into UDP on port 123 shaped to look like NTP, reaching out to hostnames built to pass a tired eye: What the operator gets from all of this is the store, from the inside: administrative access, the Magento encryption key, REST, SOAP, GraphQL and OAuth tokens, payment-gateway API credentials, and the integrity of the checkout page itself. On an e-commerce host, that last item is the one that turns a server compromise into a skimming operation against every customer who pays.<\/p>\n\n\n\n A vulnerability is a door. What decides the outcome is the threat actor walking through it, and how they work once inside. Our Threat Intelligence team tracks StyleSmuggler within a scope of 287 adversary groups and offensive tools, and has integrated the indicators below into the Fortgale Intelligence Feed for preventive blocking across our client base.<\/p>\n\n\n\n <\/p>\n\n\n\nstyles<\/code> properties, reported to be reachable through an unauthenticated GraphQL request, to smuggle PHP source past the platform’s template safeguards and into a file Magento writes itself during normal operation: a payment failure report under var\/report\/<\/code>, or an entry in var\/log\/system.log<\/code>. Nothing executes yet. The code is just sitting in a log.<\/p>\n\n\n\nstyles<\/code> property over GraphQL) is asserted consistently by independent analysts but is not spelled out in Adobe’s bulletin, so we mark that link of the chain as high, not certain.<\/p>\n<\/div>\n\n\n\nWhat lands: the backdoor<\/h2>\n<\/div>\n\n\n\n
chronyd<\/code> variant our Threat Intelligence team pulled from internal investigations.<\/p>\n\n\n\n▸ 2.1 <\/span>Persistence through the cron spool<\/h3>\n\n\n\n
crontab<\/code> replacement path, which sidesteps the logging that a crontab edit would otherwise leave behind. The entry re-launches the binary on a short interval, observed between five and thirty minutes across variants, so a killed process is back within the hour. An operator who checks only for recent crontab<\/code> modifications, and not the spool contents, will not see it.<\/p>\n\n\n\n▸ 2.2 <\/span>Hiding in plain sight<\/h3>\n\n\n\n
[kworker\/u:8:0]<\/code>, borrowing the bracketed naming of a Linux kernel worker thread that an administrator scrolls past by reflex. Later ones copy themselves to ~\/.cache\/fontconfig\/fc-cache<\/code>, a path that reads exactly like the font cache, or run as gvfsd-user<\/code> and chronyd<\/code>, the names of real desktop and time-synchronisation daemons. The evasion is entirely at the level of naming and location: on a busy server, a familiar name in a familiar place is the cheapest camouflage there is.<\/p>\n\n\n\n▸ 2.3 <\/span>Command and control shaped like normal traffic<\/h3>\n\n\n\n
ntp.timesync.net<\/code>, time.microsft.run<\/code>, pool.microsft.studio<\/code>. Before calling home the implant learns its own public address through legitimate lookup services (ipify<\/code>, icanhazip<\/code>, ident.me<\/code>, ipinfo.io<\/code>), a step that itself generates only benign-looking requests. In at least one analysed case no outbound C2 was seen at all while the implant was resident, a reminder that absence of C2 traffic is not absence of compromise.<\/p>\n\n\n\nThe threat actor, not the CVE<\/h2>\n<\/div>\n\n\n\n
▸ 3.1 <\/span>MITRE ATT&CK mapping<\/h3>\n\n\n\n