Affected Systems

Adobe Commerce 2.4.4 through 2.4.9 (all 2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (all 2026-aug and earlier). Affects all installations using vulnerable versions.

Exploitation Status

Active exploitation confirmed in the wild since September 4, 2026. Attackers deploying Rust-based Linux backdoors and PHP web shells via PHP code injection in Magento's template system. Exploitation attempts observed from IP addresses in China and Romania.

Business Impact

CVSS 10.0 critical flaw enabling unauthenticated remote code execution on Adobe Commerce and Magento stores. Threat actors exploit the template system to inject PHP code via "Payment Transaction Failed Reminder" email generation. Compromised servers can be backdoored within 50 minutes of exploitation. E-commerce sites face data theft, payment card skimming, and persistent access by attackers. Adobe has confirmed active targeting of Commerce merchants.

Urgency

🔴 Immediate

Recommended Actions

  • Apply the VULN-39341 hotfix immediately from repo.magento.com/patch/VULN-39341-composer-patches.zip for your specific Adobe Commerce or Magento Open Source version
  • Rotate all encryption keys after patching as required by Adobe's remediation guidance
  • Search web server logs for suspicious POST requests to email template endpoints or Payment Transaction Failed Reminder activity since September 4, 2026
  • Scan for indicators of compromise including unexpected Rust binaries in system directories and PHP web shells in webroot or upload directories
  • Monitor outbound connections from web servers for command-and-control traffic to unknown external IPs, particularly from China and Romania

---

# Threat Actor Context

Actor Profile

Sansec is a Dutch e-commerce security company specializing in threat research and protection for online retail platforms. In this instance, Sansec identified and named the StyleSmuggler vulnerability (CVE-2026-75650) affecting Adobe Commerce and Magento Open Source. The company discovered active exploitation beginning September 4, 2026, where threat actors leveraged the zero-day to deploy Rust-based Linux backdoors and PHP web shells against e-commerce merchants. Sansec's research focuses on protecting the e-commerce ecosystem from payment skimming, backdoors, and supply chain attacks targeting online stores.

TTPs (Tactics, Techniques, Procedures)

The StyleSmuggler exploitation chain leverages T1190 (Exploit Public-Facing Application) through CVE-2026-75650, a maximum-severity (CVSS 10.0) PHP code injection flaw in Magento's template system. Attackers abuse the template-processing and dependency-injection code to generate a "Payment Transaction Failed Reminder" email, triggering arbitrary code execution without authentication. Post-exploitation TTPs include T1505.003 (Server Software Component: Web Shell) via PHP dropper deployment, and T1059.004 (Command and Scripting Interpreter: Unix Shell) through a Rust-based Linux backdoor that establishes C2 connectivity to external servers for command execution. The attack chain represents T1203 (Exploitation for Client Execution) leading to persistent access mechanisms on compromised e-commerce infrastructure.

Targets & Patterns

Sansec's research identified targeting of Adobe Commerce and Magento Open Source installations, specifically focusing on e-commerce merchants and retail sector organizations. The vulnerability affects a broad range of versions (Adobe Commerce 2.4.4 through 2.4.9-2026-aug, Adobe Commerce B2B 1.3.3 through 1.5.3-2026-aug, and Magento Open Source 2.4.6 through 2.4.9-2026-aug), creating a large attack surface. Exploitation attempts originated from IP addresses in China and Romania, with Previdian honeypots recording 12 attempts since September 7, 2026. One Magento server managed by an e-commerce development platform was compromised within 50 minutes of the first confirmed exploitation on September 4, 2026, at 10:20 p.m. UTC, demonstrating rapid weaponization. The targeting pattern reflects adversary interest in high-value e-commerce infrastructure for payment data theft, persistent access, and potential supply chain compromise.

Historical Context

This represents a newly disclosed zero-day vulnerability discovered by Sansec in September 2026. The research builds on Sansec's established focus on e-commerce security threats, particularly targeting Magento/Adobe Commerce platforms. The StyleSmuggler campaign marks active exploitation of a critical unauthenticated remote code execution vulnerability with immediate real-world impact. Adobe's rapid patch release and acknowledgment of in-the-wild exploitation indicates the severity and active threat landscape. The deployment of both Rust backdoors and PHP web shells demonstrates adversary sophistication and multi-platform capabilities. This incident follows a pattern of e-commerce platform targeting where threat actors seek persistent access to merchant infrastructure for financial gain and data exfiltration.

Defensive Recommendations

  • Immediately apply the VULN-39341 patch from Adobe's hotfix repository (repo.magento[.]com/patch/VULN-39341-composer-patches.zip) and rotate encryption keys as specified in Adobe's advisory
  • Monitor for T1190 exploitation attempts by inspecting web server logs for suspicious POST requests to Magento template processing endpoints, particularly those generating 'Payment Transaction Failed Reminder' emails
  • Detect T1505.003 web shell deployment by scanning for newly created PHP files in web-accessible directories and monitoring for unusual PHP execution patterns, especially files with obfuscated code or external network connections
  • Identify T1059.004 Rust backdoor activity by monitoring for unexpected outbound connections from web servers to external C2 infrastructure and unusual Linux process execution originating from web application contexts
  • Implement network segmentation to restrict e-commerce server outbound connectivity and deploy application-layer firewalls with rules blocking unauthenticated access to Magento template processing functions