StyleSmuggler Zero-Day Reportedly Enables Unauthenticated RCE on Magento and Adobe Commerce
Summary
Aikido reports an unauthenticated GraphQL-to-template RCE affecting current Magento Open Source and Adobe Commerce, with exploitation reported since September 4. The post conflicts on whether Adobe has issued hotfixes.
Key points
- The article describes StyleSmuggler as an unauthenticated RCE affecting current Magento Open Source and Adobe Commerce versions, including 2.4.9.
- The reported exploit injects PHP through GraphQL style properties; the payload is later executed during payment-failure email template rendering.
- Sansec reportedly observed attack traffic starting September 4, 2026, and reproduced the attack chain on clean installs of versions 2.4.7, 2.4.8, and 2.4.9.
- The article says confirmed intrusions installed a persistent Rust-based backdoor, and advises rotating Magento credentials if evidence of compromise is found.
- Aikido describes fixes for multiple package branches and suggests temporarily disabling GraphQL as an interim measure, while noting the impact on headless or PWA storefronts.
- Adobe's patch status is inconsistent in the article: its update says urgent hotfixes were released and lists CVE-2026-75650, while the body says Adobe had not issued a CVE or patch.
Article Details
- Vulnerability Types
- Remote code execution
- PHP code injection through GraphQL style properties
- Severity
- Critical (CVSS 10/10)
- Affected Versions
- Magento Open Source 2.4.7
- Magento Open Source 2.4.8
- Magento Open Source 2.4.9
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Temporarily disable GraphQL if unable to apply a patch immediately.
MITRE ATT&CK
CVE
Vendors
Products
Adobe Commerceattackers remote code execution against every current version of Magento Open Source and Adobe Commerce, and it has been under active exploitation since September 4. Sansec published its research onAikido IntelAikido Intel picked this up and rated it critical before Adobe had assigned a CVE number, and Aikido Libraries already has a working fix for multiple affected versions. This post covers how the exploit works, who itAikido LibrariesAikido Intel picked this up and rated it critical before Adobe had assigned a CVE number, and Aikido Libraries already has a working fix for multiple affected versions. This post covers how the exploit works, who itMagentogives unauthenticated attackers remote code execution against every current version of Magento Open Source and Adobe Commerce, and it has been under active exploitation since September 4. Sansec published