Unpatched Magento/Adobe Commerce Zero-Day (StyleSmuggler) Actively Exploited

Sun, 06 Sep 2026 14:08:28 +0000

Engineer — Act: Unauthenticated RCE with active exploitation since September 4 and no patch yet — apply Sansec’s recommended WAF/mitigation rules immediately, audit Magento/Adobe Commerce file systems and web roots for newly dropped backdoors, and consider restricting public access to admin paths until a patch is released.
SOC/IR — Act: Active exploitation campaign targeting Magento/Adobe Commerce via StyleSmuggler began September 4 — hunt for anomalous POST requests to layout/XML-related endpoints and for new or modified PHP files in web roots on those servers since that date, and tune file-integrity and web-shell detection rules accordingly.
Leader — Act: An actively exploited zero-day with unauthenticated RCE on e-commerce servers puts payment card and customer data at immediate risk — confirm whether your organization or key vendors run Magento/Adobe Commerce, assess PCI DSS breach-notification obligations, and brief leadership given the likelihood of press coverage.

Magento on CuraSec