Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Summary: Sansec said on September 5 that attackers are exploiting an unpatched Magento Open Source and Adobe Commerce flaw it named StyleSmuggler, with attacks starting September 4 and giving unauthenticated code execution and a persistent backdoor on store servers. As of September 6 Adobe had published no advisory, CVE, patch, or workaround, and Sansec said all current versions are affected, including 2.4.9, with the full chain reproduced on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9.
What you should know: Disrex, which handled two compromised stores, said both were breached inside the roughly eight-hour window between first observed exploitation and the first available defence, and that patch status was irrelevant: one victim ran 2.4.6-p15 with Adobe's July and August 2026 updates applied, the latest patch level for that line.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026