Security firm Sansec has uncovered StyleSmuggler, an unauthenticated remote code execution zero
day in Magento and Adobe Commerce that attackers have been exploiting since 4 September 2026,
three days before a fix existed. Adobe rushed out an emergency hotfix on 7 September for CVE-2026
75650, its highest priority rating and a maximum CVSS score of 10.0. The flaw injects malicious PHP
through Magento’s template system and runs it when the store renders a failed-payment email,
requiring no login and no user action. Every version from 2.4.4 to 2.4.9 is affected, including fully
patched stores, and successful attacks drop a stealthy backdoor that hides as a system process and
beacons out over traffic disguised as time-sync (NTP). Because the hotfix does not clean a store that
was already hit, merchants must patch, scan for compromise, and rotate their encryption key and all
protected credentials without delay.
1. Vulnerability Details
CVE ID – CVE-2026-75650 (StyleSmuggler; Adobe APSB26-146)
CVSS SCORE – 10.0 (Adobe; priority rating 1)
EXPLOIT STATUS – Exploited in the wild since 4 Sep 2026; emergency hotfix published 7 Sep 2026. Operators
change payloads several times a day. Patching does not remediate an already-compromised
store.
StyleSmuggler injects malicious PHP into Magento’s template system using the styles properties to evade existing
safeguards. It works in two stages: it first poisons PHP code (for example by generating a failure report), then lets
Magento execute that code while rendering a standard ‘Payment Transaction Failed Reminder’ email. The chain is
unauthenticated, needs no user to open the email, and can succeed even when email delivery fails. Moving sessions to
Redis or the database does not stop it, and a clean security:patch-status is no defence.
2. Affected Products
- Adobe Commerce and Magento Open Source 2.4.4 to 2.4.9, and Adobe Commerce B2B 1.3.3 to 1.5.3. Every version in these branches is affected, including fully patched stores (Sansec saw a 2.4.6-p15 store with July/August patches compromised and a 2.4.7-p10 store probed).
- Fix: apply Adobe’s emergency hotfix for CVE-2026-75650 (APSB26-146). It ships as a composer patch, VULN-39341 (VULN-39341-composer-patches.zip from repo.magento.com), not as a full release. Confirm with: vendor/bin/magento-patches -n status.
3. Exploitation & Payload
Attacks are ongoing and the operators iterate quickly; a successful exploit installs a persistent backdoor.
- Active exploitation Sansec confirmed the first exploitation on 4 Sep 2026 and reproduced the full unauthenticated chain on clean 2.4.7, 2.4.8 and 2.4.9. Operators have changed payloads several times a day, and patched stores have still been hit.
- Rust backdoor Successful exploitation launches a small Rust backdoor disguised as a system process ([kworker/u:8:0], then fc-cache, then chronyd) that beacons to C2 over WebSocket-over-TLS and over NTP-shaped UDP port 123 traffic, persisting via cron entries written directly to the spool file.
- Second, unrelated actor Sansec also observed a separate threat actor using the same flaw to drop a PHP web shell into the product image cache, so removing the backdoor process alone is not sufficient; check for suspect PHP under pub/media.
4. Indicators of Compromise (IOCs)
| Type | Indicator |
| URL | hxxps://www.incofar[.]it/js/jquery/plugins/ajaxfileupload/mag.txt (malware download) |
| DOMAIN | 247.cdnflare[.]xyz (malware download host) |
| IP | 209.141.43[.]95 (malware download host) |
| IP | 99.84.67[.]186 (C2, WebSocket over TLS, 443) |
| DOMAIN | windsecurity[.]run (remote shell, WebSocket over TLS, 443) |
| DOMAIN | ntp.timesync[.]net (C2, NTP-shaped UDP 123) |
| DOMAIN | time.microsoft[.]run (C2, NTP-shaped UDP 123) |
| DOMAIN | pool.microsoft[.]studio (C2, NTP-shaped UDP 123) |
| DOMAIN | ntp.timesync[.]to (C2, NTP-shaped UDP 123, fc-cache build) |
| IP | 185.157.160[.]251 (A record for ntp.timesync[.]to / ntp.timesync[.]net, UDP 123) |
| DOMAIN | ntp.synctime[.]to (C2 fallback) |
| DOMAIN | ntp.syncstime[.]to (C2 fallback) |
| IP | 88.216.72[.]181 (attacker source, seen at multiple victims) |
Recommendations
- Apply Adobe’s emergency hotfix for CVE-2026-75650 immediately (APSB26-146, composer patch VULN39341 from repo.magento.com) and confirm installation with ‘vendor/bin/magento-patches -n status’. It is a hotfix, not a full release, and a clean security:patch-status is no defence.
- Assume compromise for any store exposed on or after 4 September 2026, because patching does not clean an already-hit store. Scan with Sansec eComscan and hunt host artefacts: processes masquerading as [kworker/u:8:0], fc-cache or chronyd, files under ~/.cache/fontconfig, /tmp/.fc_* and /tmp/.chrony-*, and cron entries written directly to the spool file.
- Hunt for injected web shells and droppers: run ‘find pub/media -name “*.php”‘, inspect for shells such as pub/media/catalog/product/cache/ss_/sync_.php (which returns 404 without an X-Cache-Token header), and investigate unexpected bursts of ‘Payment Transaction Failed Reminder’ emails.
- Rotate the Magento encryption key and every credential it protected, at the source: admin passwords, REST/SOAP/GraphQL and integration tokens, OAuth secrets, payment-gateway API credentials, database credentials, SSH and deploy keys, and third-party extension keys. Rotating the key alone does not invalidate what an attacker already read.
- Deploy a virtual patch or WAF (such as Sansec Shield) to block both exploitation stages, and monitor for the NTP-disguised C2: nine 48-byte NTPv4 server-mode datagrams roughly 10 milliseconds apart every 60 seconds on UDP port 123 is the tell, so treat outbound UDP/123 to ntp.* hosts you do not operate as suspect.
- Block the network IOCs at their respective controls (the C2 and malware-download hosts listed in the Indicators of Compromise section) across your perimeter, DNS and endpoint controls.
Sources
- https://sansec.io/research/stylesmuggler-0day
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.