Full Report
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is publishing early
Analysis Summary
# Vulnerability: StyleSmuggler (Unpatched Magento/Adobe Commerce RCE)
## CVE Details
- **CVE ID:** Not yet assigned (Zero-day)
- **CVSS Score:** N/A (Estimated Critical based on unauthenticated RCE)
- **CWE:** Likely CWE-94 (Code Injection) or CWE-502 (Deserialization) involving GraphQL
## Affected Systems
- **Products:** Magento Open Source, Adobe Commerce, Adobe Commerce on Cloud.
- **Versions:** All current versions are reportedly affected, including 2.4.9, 2.4.8, 2.4.7 (specifically 2.4.7-p2 and 2.4.7-p10), and 2.4.6-p15 (patched to August 2026 levels).
- **Configurations:** Systems with the **GraphQL** interface enabled. Headless and Progressive Web App (PWA) storefronts are particularly at risk as they rely on GraphQL.
## Vulnerability Description
StyleSmuggler is an unauthenticated Remote Code Execution (RCE) flaw. Attackers exploit the GraphQL API to execute malicious code on the online store's server without requiring valid login credentials. The attack chain allows for the installation of a persistent backdoor and lateral movement within the server environment.
## Exploitation
- **Status:** **Exploited in the wild.** Attacks were first detected on September 4, 2026.
- **Complexity:** Low (Targeting unauthenticated endpoints).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to server data and session storage).
- **Integrity:** High (Backdoors installed; attackers can modify site files and database).
- **Availability:** High (Potential for site takeover or resource exhaustion).
## Remediation
### Patches
- **No patch currently available.** As of September 6, 2026, Adobe has not released an official security bulletin or fix.
### Workarounds
- **Disable GraphQL:** For stores that do not require GraphQL (most classic and Hyvä storefronts), disabling this service is the primary mitigation.
- **Shielding:** Sansec Shield users have received automated blocking rules.
- **WAF Rules:** Implement web server rules to filter suspicious GraphQL traffic based on captured attack patterns.
## Detection
### Indicators of Compromise (IoC)
- **Malicious Process:** A background process disguised as a Linux kernel thread: `[kworker/u:8:0]`.
- **Malicious Binary:** A stripped, statically linked Rust program (~1.9 MB) located at `~/.local/share/.gvfsd/gvfsd-user`.
- **Persistence:** A cron entry in `/var/spool/cron/crontabs/` that restarts the implant every five minutes.
- **Network Activity:** High number of internal connections to the local Redis instance (port 6379) to read session storage.
### Detection Methods
- Check `crontab -l` or inspect spool files for unexpected repetitive entries.
- Monitor active processes for suspicious `kworker` threads running from user directories.
- Audit GraphQL logs for unusual query patterns from unauthenticated sources.
## References
- Sansec Advisory: `hxxps[:]//sansec[.]io/research/stylesmuggler`
- Disrex Group Mitigation Repo: `hxxps[:]//github[.]com/disrex-group/stylesmuggler-mitigation`
- Adobe Security Index: `hxxps[:]//helpx[.]adobe[.]com/security/products/magento[.]html`