Magento Zero-Day 'StyleSmuggler' Lets Attackers Backdoor Online Stores
Sansec says exploitation of the unpatched Adobe Commerce flaw began September 4, with no vendor fix yet available.
Key points
- Dutch e-commerce security firm Sansec disclosed an unpatched flaw in Magento Open Source and Adobe Commerce on September 5.
- Attacks in the wild started on September 4, according to Sansec's advisory.
- The bug, nicknamed StyleSmuggler, lets attackers run their own code on a shop's server without needing a login.
- Adobe has not yet released a patch at the time of publication.
- Shops running Magento or Adobe Commerce are being told to check logs and lock down admin access now.
Criminals are attacking online stores built on Magento Open Source and Adobe Commerce using a flaw that Adobe hasn't fixed. Dutch e-commerce security firm Sansec, which found the bug, is calling it StyleSmuggler and says the first attacks landed on September 4. Sansec published its advisory on September 5 precisely because exploitation was already live. If you run a store on this software, assume you're a target this week.
What is actually broken?
StyleSmuggler is an unauthenticated remote code execution flaw: an attacker on the open internet can make the shop's server run commands without ever logging in. That's close to the worst grade of web vulnerability there is. It hands the intruder access to the checkout flow, the customer database and the payment pipeline.
Sansec hasn't published full technical detail, and that's deliberate. The firm went early with a warning because attacks were already running and site owners needed time before Adobe ships a patch.
Who is affected?
Both the free Magento Open Source project and the paid Adobe Commerce product are in scope. Together they power a large slice of independent online retail, from small boutiques to household-name brands. Adobe inherited Magento in 2018 and now ships it as Adobe Commerce. Fixes for both products typically arrive together on Adobe's security bulletin schedule.
We covered a separate Adobe Commerce flaw on 12 August, when Sansec reported its firewall was already blocking live exploitation of CVE-2026-71362, another no-login, no-click vulnerability. Two critical Adobe Commerce flaws in under a month is a pattern worth watching.
What are attackers doing with it?
Sansec's advisory points to attackers using StyleSmuggler to plant backdoors on stores. Once a Magento server is compromised, criminals typically drop a small piece of hidden code, often called a web skimmer, which quietly copies shoppers' card numbers as they type them at checkout and sends the data to attacker-controlled infrastructure. Shoppers see nothing wrong.
This family of attacks is called Magecart, and it has been running against Magento shops for years. The failure mode is depressingly familiar: a critical bug drops, exploitation starts within days, and a long tail of smaller shops never patches.
What should shop owners do right now?
Treat this as an active incident, not a heads-up. There's no patch yet, so the useful moves are containment.
| Item | Detail |
|---|---|
| Affected products | Magento Open Source, Adobe Commerce |
| Flaw nickname | StyleSmuggler |
| Flaw type | Unauthenticated remote code execution |
| Disclosed by | Sansec, September 5 |
| Exploitation started | September 4 |
| Patch status | None at time of writing |
Restrict access to the Magento admin panel by IP address. Put the site behind a web application firewall with virtual patching rules for Magento. Review server logs and the filesystem for files you didn't create, especially anything modified since September 3. Watch Adobe's security bulletins page for an emergency fix.
What about shoppers?
Ordinary customers can't tell from the outside whether a store has been backdoored. The sensible habit is to pay with a credit card or a wallet service like PayPal or Apple Pay rather than a debit card. Credit and wallet payments give you a chargeback route if a skimmer scoops your details.
Bottom line: two no-login Adobe Commerce flaws in a month, with active exploitation on both. The CVE number will follow the patch. Your weekend job is log review and admin lockdown, not waiting for it.
