Unpatched Magento/Adobe Commerce Zero-Day "StyleSmuggler" Used to Backdoor Online Stores

Sansec, a Dutch e-commerce security firm, disclosed on September 5, 2026 that attackers are actively exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce. The flaw, which Sansec dubbed StyleSmuggler, reportedly allows unauthenticated remote code execution against the store's server. Sansec says it discovered the issue and that in-the-wild exploitation began on September 4, 2026. No CVE identifier or patch was available at the time of reporting.

Why It Matters

Magento Open Source and Adobe Commerce power a large share of online retail storefronts, and unauthenticated RCE against them is about as severe as e-commerce risk gets: it can lead to full server compromise, payment-skimming (Magecart-style) injections, admin backdoors, and theft of customer and payment data. Because the vulnerability is unpatched, any store running affected Magento/Adobe Commerce versions should be considered potentially exposed until Adobe or Sansec publish further guidance or a fix.

What Defenders Should Watch For

• Monitor Sansec's advisory and Adobe's security bulletins closely for indicators of compromise, affected version ranges, and any emergency patch or mitigation guidance as they become available.
• Review web server and application logs for unusual or unauthenticated requests to Magento/Adobe Commerce endpoints around and after September 4, 2026, particularly anything touching theme, style, or CSS-related processing paths given the "StyleSmuggler" naming.
• Hunt for newly created or modified admin users, unfamiliar PHP files or webshells, and unexpected changes to storefront templates/JavaScript that could indicate a skimmer implant.
• Consider virtual patching or WAF rules for anomalous requests to Magento/Adobe Commerce if a vendor advisory identifies specific request patterns, and restrict/monitor access to admin and API endpoints in the meantime.
• Ensure backups and integrity monitoring are in place so unauthorized file or database changes can be detected and rolled back quickly.

This is developing, net-new intelligence with no CVE assigned and no confirmed patch at time of writing; specifics of the exploitation technique and affected versions may change as Sansec and Adobe release more detail. For the original reporting, see The Hacker News.