A new, unpatched vulnerability in Magento Open Source and Adobe Commerce is being actively exploited in the wild. Dutch e-commerce security firm Sansec, which discovered the flaw and named it StyleSmuggler, published an emergency advisory on September 5 stating that “stores are being compromised right now.” Attacks began on September 4, and as of September 6 Adobe has not issued a CVE identifier, patch, or workaround.
The attack works in two stages. First, an attacker plants malicious PHP code inside a file that Magento itself writes when generating a failure report. Then it triggers Magento’s built-in “Payment Transaction Failed Reminder” email, which causes the server to execute the planted code while rendering the message — no user needs to open anything, and the attack succeeds even if email delivery fails. A successful compromise installs a persistent backdoor disguised as a Linux kernel thread named [kworker/u:8:0], with its binary hidden under the site user’s home directory rather than the web root. A cron entry restores the implant within one second of removal, and on one compromised store that entry was written 1,728 times. Sansec confirmed full unauthenticated exploitation chains on Magento Open Source 2.4.7, 2.4.8, and 2.4.9, and at least one victim was running the latest available patch level for its release line, meaning patch status alone is not a reliable defense.
How to check if you’re affected
Affected versions include all current releases of Magento Open Source and Adobe Commerce — 2.4.6 through 2.4.9 — even those at the latest patch level. Check your store for these indicators of compromise:
- A process named
[kworker/u:8:0]owned by a non-root user with real resident memory (genuine kernel threads are owned by root and carry no resident memory). - Files at
~/.local/share/.gvfsd/gvfsd-user(the implant binary) or insidevar/report/orvar/log/system.logcontaining the stringX_TRACE_orX-TRACE-followed by hex characters. - Unexplained bursts of “Payment Transaction Failed Reminder” emails from your store.
If email delivery is optional for your site and you don’t require GraphQL, Sansec recommends temporarily disabling GraphQL as an interim mitigation until Adobe ships a patch. Unofficial Nginx/Apache blocking rules and a Magento source patch for the underlying DI code are available from Disrex Group’s GitHub. Adobe’s next scheduled security release is September 8, 2026.