StyleSmuggler attack and exploitation compromises Magento 2.4.x Open Source Stores
On the evening of September 4, 2026, attackers began exploiting a previously unknown flaw in Magento Open Source and Adobe Commerce. E-commerce security firm Sansec discovered the campaign, named it StyleSmuggler, and published its findings the next morning. Adobe later tracked the issue as CVE-2026-75650 and rated it CVSS 10.0, the maximum possible severity. For merchants running Magento 2.4.x, this was not a theoretical risk. Stores were being compromised in real time.
What makes StyleSmuggler different
StyleSmuggler is an unauthenticated remote code execution vulnerability. That means an attacker with no account, no admin password, and no installed plugin can run their own code on the server hosting your store. Every version from 2.4.4 through 2.4.9 was affected. Most alarming, the first known victim was running Magento 2.4.6-p15 with the July and August 2026 security patches installed, and the store's patch-status check reported clean.
How the attack works
The exploit abuses Magento's template system in two stages. First, the attacker sends a crafted request, reportedly through GraphQL, that uses a styles property to slip PHP code past existing safeguards and into content Magento generates, such as a failure report. Second, the attacker triggers Magento's routine "Payment Transaction Failed Reminder" email. When Magento renders that email template, the poisoned code executes on the server. Nobody needs to open the email, and the attack can succeed even if the email is never delivered.
What attackers do after getting in
Once inside, attackers deployed a compact Rust-based backdoor that disguises itself as a Linux kernel worker process, later as fc-cache, to blend in with normal system activity. Researchers reported that one group, Lockster, compromised more than 3,800 stores, and that exfiltrated data on its infrastructure included payment gateway private keys. For a DTC merchant, that translates directly to card-data exposure, chargebacks, PCI obligations, and lost customer trust.
Patch timing left a dangerous gap
Adobe shipped an emergency hotfix on September 7, three days after the first confirmed exploitation. The patch closes the door, but it does not clean a store that was already entered. Any unpatched, internet-facing store between September 4 and 8 should be treated as potentially compromised until proven otherwise.
What Magento merchants should do now
- Apply Adobe's StyleSmuggler hotfix (APSB26-146) to every Magento instance, and verify it on staging and production.
- Hunt for indicators: unexpected surges in failed-payment reminder emails, unfamiliar
kworkerorfc-cacheprocesses, suspicious cron entries, and odd temporary files. - Rotate admin, database, API, and payment gateway credentials if compromise is suspected.
- Place a web application firewall in front of the store, and restrict or disable GraphQL if your storefront does not depend on it.
- Confirm that backups are clean, recent, and restorable before you need them.
StyleSmuggler is a reminder that a fully patched store is not automatically a safe store. If you are unsure whether your Magento store was exposed, EStronghold's Security and Operations Assessment and Incident Triage services can help you find out quickly. For an active incident, email [email protected].