Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
A zero-day vulnerability in Adobe Commerce and Magento is being exploited by threat actors to install backdoors on online stores. The attackers leverage a ‘Payment Transaction Failed Reminder’ email to inject malicious PHP code, allowing them to execute commands and gain control of the affected systems. The vulnerability affects specific Magento versions and has been actively exploited since September 4th.
A zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms is being actively exploited by threat actors to install backdoors on online stores, according to cybersecurity firm Sansec. The vulnerability, dubbed StyleSmuggler, allows attackers to inject PHP code into Magento’s template system, bypassing security measures by utilizing the ‘styles’ properties.
According to Sansec, the attack unfolds in two stages: first, the PHP code is injected by generating a failure report, and then Magento executes the code via a failed payment email. The remote code execution (RCE) flaw targets Magento versions 2.4.7, 2.4.8 and 2.4.9, and has been exploited against deployments running the July and August 2026 patches.
Successful attacks have been deploying a backdoor against Commerce and Magento stores. The malware, written in Rust, connects to a command-and-control (C&C) server and waits for commands. Sansec discovered the campaign on September 4th at 22:40 UTC and successfully reproduced the attack chain on clean installations within hours.
The malware hides its C&C communication as NTP server replies, carrying host information including agent ID, hostname, username, memory and disk usage, OS version, uptime, root access, and implant version. It also identifies the store’s public IP before beaconing to the C&C. Sansec notes that unexpected bursts of ‘Payment Transaction Failed Reminder’ emails are a key indicator of the attack.
Adobe is scheduled to release fixes on September 8th as part of its monthly Patch Tuesday updates, but it remains unclear when StyleSmuggler will be addressed. SecurityWeek has contacted Adobe for a statement and will update this article if the company responds.