A new critical vulnerability is putting Magento stores at risk, with attackers already exploiting the flaw in the wild. Security firm Sansec has dubbed the vulnerability “StyleSmuggler”, warning that it can be used to execute malicious code on a store’s server without requiring any login.
The first attacks were spotted on September 4, 2026, and several Magento Open Source stores have already been compromised. Sansec says its testing confirmed the attack on recent versions including 2.4.7, 2.4.8 and 2.4.9. So far, Adobe has not released a patch, CVE, or official workaround.
Once exploited, the flaw can give attackers a foothold on the server and allow them to install a persistent backdoor. Researchers found an implant that disguises itself as a legitimate Linux kernel process, survives reboots through a cron job, and can access Magento session data stored in Redis.
Independent investigations by Magento hosting company Disrex have also confirmed multiple compromises. Interestingly, one of the affected stores was running a relatively recent version of Magento and had Sansec’s security solution enabled, highlighting the fact that simply being up to date with the latest available security patches does not protect against this newly discovered flaw.
For now, security researchers recommend temporarily disabling GraphQL where possible, checking servers for suspicious files, processes and cron jobs, and keeping an eye out for unusual Magento emails. In particular, failed-payment notifications containing raw template variables or other broken-looking content could be an early sign of an attack.
Stores that may have been compromised should be treated as a full security incident. Researchers recommend preserving evidence, invalidating active sessions and rotating admin passwords, API keys and other credentials used by the Magento installation.
Adobe’s next scheduled security update is due on September 8, although it is not yet clear whether it will include a fix for StyleSmuggler.