Somewhere out there, a hacker looked at Magento's password-reset-reminder emails and thought, "you know what would be fun? Turning that into a loaded gun." Enter StyleSmuggler, the zero-day that spent a week backdooring online stores before anyone even had a patch to argue about installing.
An Unauthenticated RCE Hiding in a Reminder Email
CVE-2026-75650, nicknamed StyleSmuggler, is a maximum-severity (CVSS 10.0) remote code execution flaw hitting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source versions 2.4.4 through 2.4.9. No login required, no social engineering needed — an attacker just talks to the server directly.
The attack is a clever two-step: first it poisons PHP code, often by triggering a failure report, then waits for Magento to unwittingly execute that code while rendering its own "Payment Transaction Failed Reminder" email. Attackers active since September 4 have used it to drop Rust-based Linux backdoors and PHP web shells, some disguising their command-and-control traffic as innocent NTP requests.
Three Days of Living Dangerously
Adobe didn't ship Hotfix VULN-39341 until September 7 — three full days after in-the-wild exploitation began. For a max-severity, unauthenticated RCE on ecommerce infrastructure that's actively processing customer payment data, that's an eternity, and multiple storefronts were already compromised by the time defenders had something to patch.
The part that should keep store owners up at night: Adobe's own advisory tells admins to enable maintenance mode, kill cron jobs, and rotate every password, token, and API key — which is basically an admission that "patched" doesn't mean "clean" if you were exposed during the window.
If your storefront runs on Magento or Adobe Commerce, patching is the bare minimum tonight, not a sprint item for next quarter.
We help businesses lock down and monitor exactly this kind of CMS/ecommerce attack surface before it becomes a 2am phone call — grab our free developer security checklist on supply-chain attacks to see where your stack might be exposed.
Source: BleepingComputer