In short: On September 5, 2026, Dutch e-commerce security firm Sansec disclosed an actively exploited zero-day in Magento Open Source and Adobe Commerce, dubbed StyleSmuggler. Attacks backdooring online stores began on September 4, giving attackers full server control with no authentication required. All current versions including Magento 2.4.9 are affected. Adobe has not released a patch, CVE, or workaround as of September 6, 2026.
What happened
Sansec, the Dutch firm specialising in e-commerce security, published its findings early — explaining it was doing so because stores are being compromised right now. The first exploitation was detected on September 4, 2026, a day before Sansec’s public disclosure.
Notably, the first confirmed victim was running Magento 2.4.6-p15 with Adobe’s July and August 2026 security patches fully applied — the highest patch level available for that branch. Being fully up to date offered no protection because StyleSmuggler exploits a flaw that no existing patch covers.
Sansec confirmed the full unauthenticated attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. According to BuiltWith, hundreds of thousands of online stores worldwide run Magento or Adobe Commerce. Our security blog tracks incidents like this from the moment they emerge.
How StyleSmuggler works
The vulnerability chains two Magento components: the email template renderer and the GraphQL request handler. The attack unfolds in two stages.
Stage one — code injection via GraphQL. The attacker sends a specially crafted GraphQL request where the styles property contains malicious PHP code. Magento accepts the request with no authentication whatsoever — no account, no password, no administrator privileges required.
Stage two — trigger via email template. StyleSmuggler then causes Magento to generate its standard Payment Transaction Failed Reminder email. The injected code executes the moment Magento renders that message internally — the email does not even need to reach a recipient for the server-side code to run.
Result — a persistent backdoor. A PHP dropper cycles through six different functions until it finds one capable of spawning a process, then downloads and installs a persistent implant. The backdoor survives on the server even if a future patch closes the original entry point.
What is at risk — shoppers’ data
Once attackers control a store’s server, they can access everything the platform holds: customer names, shipping addresses, phone numbers, email addresses, and order histories. If the store processes payment cards directly without redirecting to an external payment gateway, card details are at risk as well.
The classic monetisation method is a skimmer: a hidden script that intercepts payment data entered by the shopper and sends it silently to the attacker’s server. This is the hallmark of Magecart-style attacks that have targeted e-commerce platforms for years.
From a shopper’s perspective, there is no easy way to tell whether a particular store has been compromised. The HTTPS padlock and a familiar site design offer no guarantee — the malicious code is hidden server-side and invisible in the browser. Protecting your own data means using virtual or single-use card numbers for online purchases and monitoring your bank statement closely.
LiMP VPN encrypts your traffic at the network level, protecting data transmission from eavesdropping on public Wi-Fi networks — a common attack point during online shopping. It is an important layer of protection, but it does not shield you from server-side store breaches: when a store is backdoored, data is stolen after payment on the merchant’s infrastructure, not in transit on your end.
Is there a patch available?
As of September 6, 2026, no. Adobe has not published an advisory, a CVE identifier, a patch, or a workaround. The Adobe Commerce security bulletin page still shows the August 11, 2026 update as the latest entry.
Adobe’s next scheduled security release is September 8, 2026, and it is not yet confirmed whether that release will cover StyleSmuggler. Until an official fix is available, Sansec recommends that store owners closely monitor server logs for unexpected PHP processes and requests to /pub/media.
If you run or manage a Magento or Adobe Commerce store — regardless of version or patch level — check your server logs immediately. Sansec has published indicators of compromise (IoCs) to help detect whether a backdoor is already present.
How to protect yourself as a shopper
While the vulnerability remains unpatched, it is worth reinforcing your own precautions when shopping online.
Use virtual or single-use card numbers — many banks offer this in their mobile app. Even if attackers capture a virtual card’s details, your main account stays safe. Enable transaction notifications by SMS or push so you spot any unauthorised charge immediately.
When shopping on public Wi-Fi (cafes, malls, airports), use LiMP VPN: an encrypted tunnel prevents network eavesdroppers from intercepting your traffic. Remember that a VPN protects data in transit but not from server-side breaches at the store — these are different threats requiring different defences.
Review your bank statements regularly and report any suspicious transactions to your bank without delay. Most banks will reimburse fraudulent charges if you report them promptly.