Adobe's Magento Zero-Day Scored a Perfect 10. Its Backdoor Pretended to Be NTP Traffic.
CVE-2026-75650, dubbed StyleSmuggler, hit unauthenticated RCE against Magento and Adobe Commerce stores three days before Adobe had a patch — and two separate attackers were racing to plant implants in the same stores.
CVE Tools6 min read
On September 4, 2026 at 22:20 UTC, someone sent Adobe Commerce a crafted request nobody had defended against, and a Magento store was fully compromised 50 minutes later. Adobe's fix didn't exist yet — it shipped three days after the first confirmed exploit. In between, at least two unrelated attacker groups worked the same vulnerability against the same class of victim stores, one planting a disposable web shell, the other installing a backdoor that disguises its command-and-control traffic as network time synchronization.
Scores as of 2026-09-14live record →
How an unauthenticated request becomes code execution
Sansec, the e-commerce security firm that found and named the flaw "StyleSmuggler," reproduced the chain on clean, fully patched Magento Open Source 2.4.7 through 2.4.9 installs. The trick abuses the styles properties inside Magento's template system to smuggle PHP past existing template-injection safeguards, then gets Magento to write that attacker-controlled content to disk as part of normal behavior — for example, inside a failure report. A second step deliberately triggers Magento's standard "Payment Transaction Failed Reminder" email. Nobody has to open that email: the poisoned code executes server-side the moment Magento renders it.
StyleSmuggler attack chain
- Unauthenticated request with malicious `styles` payload
- Magento writes attacker PHP to disk (e.g. a failure report)
- Attacker triggers "Payment Transaction Failed Reminder" render
- PHP executes server-side during template rendering
- Web shell dropped in pub/media/ cache path
- Rust backdoor installed, beacons disguised as NTP
Two operators, two toolkits, the same open door
Who was in these stores
- Rust binary, x86-64 and arm64 builds
- Installs at ~/.local/share/.gvfsd/gvfsd-user
- Masquerades as [kworker/u:8:0], then renamed to fc-cache (Sep 6), then chronyd (Sep 7)
- Cron persistence, sometimes written straight into the cron spool to skip syslog
- Beacons over UDP/123 shaped like NTP traffic to evade network monitoring
- Checks /proc/self/status for TracerPid — installs but never beacons if it detects a debugger
- 485-byte PHP dropper
- Web shell written to pub/media/catalog/product/cache/ss_/sync_.php
- Returns HTTP 404 to any request lacking a specific X-Cache-Token header
- Used DNS-based exfiltration via an OAST callback domain
- No persistence mechanism observed beyond the shell file itself
- Probed a separately patched 2.4.7-p10 store on Sep 7
Three days, hour by hour
StyleSmuggler timeline
- First confirmed exploitationSansec's first recorded hit against a live store
- Compromise confirmed 50 minutes laterNetherlands incident-response firm Disrex documents a full compromise on an unrelated store
- Sansec ships Shield detection rulesSame day it reproduces the chain on clean 2.4.7–2.4.9 installs and publishes the "StyleSmuggler" research
- Backdoor renamed to fc-cacheImplant version 2.1.4 swaps its process-masquerade name
- Second operator probes a patched storePHP web-shell campaign attempts pub/media write access against a 2.4.7-p10 install
- Backdoor renamed to chronydImplant version 2.1.5 — this variant can relaunch with no cron entry at all
- Adobe ships the hotfixAPSB26-146, composer patch VULN-39341, released out-of-band
- Backported to 41 older versionsThird-party Magento shop Scandiweb ships unofficial backports; CISA adds the CVE to its KEV catalog the same day
- WAF vendors catch upCloudflare and Imperva ship managed rules targeting the exploit pattern
[StyleSmuggler] turns Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain.
The rest of Adobe's September basket
CVE-2026-75650 shipped inside a much larger Adobe security release — over 170 fixes across products, including three more CVSS 9+ critical bugs published the very next day. None of the others are known to be exploited, which is the point: StyleSmuggler is the one where the gap between disclosure and patch mattered because attackers were already inside.
| CVE | Product | CVSS | In CISA KEV | Confirmed exploited |
|---|---|---|---|---|
| CVE-2026-75650 | Adobe Commerce / Magento Open Source | 10.0 | Yes (added Sep 8) | Yes — since Sep 4 |
| CVE-2026-82004 | Adobe Campaign Classic | 10.0 | No | No |
| CVE-2026-48273 | ColdFusion | 9.9 | No | No |
| CVE-2026-75746 | ColdFusion | 9.1 | No | No |
Detection and response
Sansec's own research page carries the full IOC list, YARA-style process signatures and its commercial Shield detection rules — use it directly rather than a re-typed summary.
- Apply Adobe's hotfix (composer patch VULN-39341, detailed in APSB26-146) for your Adobe Commerce, Commerce B2B, or Magento Open Source version
- Rotate the encryption key and everything it protects: admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH and deploy keys, extension API keys
- Hunt before you assume you're clean: check for processes named kworker, fc-cache, or chronyd running from unexpected paths, and for PHP files under pub/media/catalog/product/cache/
- Review outbound traffic for repeated small UDP packets to port 123 that don't match legitimate NTP client behavior
- Patching alone does not remediate an existing compromise — if your store was internet-reachable between Sep 4 and Sep 7, treat it as a suspected-breach investigation, not just a patch cycle
CVE and KEV data as of 2026-09-14