Attackers are exploiting an unpatched remote code execution flaw in Adobe Commerce and Magento Open Source to install persistent backdoors on e-commerce sites, Dutch security firm Sansec reported, with the first intrusions observed Sept. 4 and no vendor fix available as of Sept. 6.
Sansec’s forensics team, in an advisory, named the flaw StyleSmuggler. No CVE identifier has been assigned. As of Sept. 7, Adobe’s Magento security bulletin index listed no September advisory, and the flaw does not appear in CISA’s Known Exploited Vulnerabilities catalog, leaving an unknown number of merchants exposed during a window in which working exploit traffic is already circulating.
Magento underpins a large share of mid-market online retail, and Adobe has sold it as Adobe Commerce since acquiring the platform in 2018. The codebase has been a durable target for payment-skimming crews: Sansec has tracked Magecart-style card theft against Magento storefronts for close to a decade, and the platform’s checkout position makes any unauthenticated code execution flaw unusually valuable.
According to Sansec’s analysis, StyleSmuggler is a two-stage chain that abuses the platform’s GraphQL interface. Attackers first inject PHP code into files Magento writes on its own, such as failure reports, then trigger execution through the platform’s “Payment Transaction Failed Reminder” email routine. Because the trigger fires when the reminder is generated, no recipient has to open the message for the payload to run.
The vulnerability was confirmed on Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The detail likely to unsettle merchants most is the first known victim: a store running 2.4.6-p15 with all available patches applied. Being current on Adobe’s release cycle did not prevent compromise.
The implant Sansec documented is built to survive routine inspection. It runs under a process name mimicking a Linux kernel thread, [kworker/u:8:0], with the binary written to ~/.local/share/.gvfsd/gvfsd-user and a cron entry relaunching it every five minutes. Sansec also listed the domain 247.cdnflare.xyz among its indicators of compromise.
Sansec advised merchants to disable GraphQL where the storefront can tolerate it, disable the PHP proc_open function, and mount /tmp, /var/tmp and /dev/shm with the noexec option. Unofficial community patches have been published by Disrex Group, ProxiBlue and Graycore. Disrex said it independently identified two compromised stores and a third that was attacked without being breached.
Adobe’s most recent scheduled Commerce bulletin, APSB26-92, was published Aug. 11 and addressed critical and important flaws across the 2.4.4 through 2.4.9 branches. The company’s next scheduled security release is Sept. 8. Adobe did not appear to have commented publicly on StyleSmuggler.
