Cybercriminals are backdooring online stores running Magento and Adobe Commerce

Adobe released an emergency fix on 7 September for a vulnerability in Adobe Commerce and Magento Open Source that cybercriminals had already been exploiting for three days. CVE-2026-75650, nicknamed StyleSmuggler, scores a maximum 10.0 out of 10 (Critical) CVSS score. It lets a cybercriminal with no username or password run their own code on a webshop and leave a backdoor behind.

What is this vulnerability?

Magento builds its pages and emails from templates, pre-written layouts with blanks the shop fills in with real data such as a customer name or an order total. The template engine is supposed to treat whatever goes into those blanks as plain text.

StyleSmuggler smuggles instructions past that check by hiding them in a template's styling properties, which existing safeguards do not inspect. The attack runs in two steps. First, a cybercriminal plants malicious code in a file the shop writes by itself, such as a payment failure report. Then they trigger the shop's standard "Payment Transaction Failed Reminder" email, and the code runs the moment the shop assembles that message. No customer or staff member has to click anything.

Why this is dangerous

Adobe confirms cybercriminals exploited this vulnerability in the wild against Adobe Commerce merchants before the fix existed. The first confirmed attack landed on 4 September, and researchers have documented at least two compromised shops in detail.

Once the code runs, an automated program downloads a permanent implant that disguises itself as a routine Linux system process and reinstalls itself every five minutes through a scheduled task. It then reports to a server the cybercriminal controls. A second group used the same vulnerability to drop web shells, hidden control pages, inside the shop's product image folders.

A webshop holds card payment flows, customer addresses, and order histories. Full control of the server lets a cybercriminal skim payment details as customers type them, steal the customer database, or hold the shop to ransom.

Affected software

Adobe Commerce and Magento Open Source 2.4.4 through 2.4.9 are affected, as is Adobe Commerce B2B 1.3.3 through 1.5.3, including the August 2026 releases. Being fully up to date offers no protection: even the current 2.4.6-p15 and 2.4.9 releases are vulnerable.

Mitigation and next steps

Apply the VULN-39341 hotfix from Adobe's security bulletin APSB26-146, available as a composer patch from repo.magento.com. Adobe also tells merchants to rotate their encryption key and every credential that depends on it. Rotate each one at its source system, not only inside Commerce:

• Admin panel passwords
• REST, SOAP, and GraphQL integration tokens
• OAuth client secrets
• Payment gateway credentials
• Database logins and deploy keys

Shops that cannot patch immediately should temporarily disable GraphQL. CISA added the vulnerability to its KEV Catalog on 8 September, giving federal agencies until 11 September to remediate - three days, the shortest window under its risk-based BOD 26-04 tiers.

Need help? 

If you have any questions, don't hesitate to reach out.