A zero-day vulnerability tracked as StyleSmuggler Magento zero-day has been actively exploited in the wild, deploying a Linux backdoor on affected e-commerce servers, and Adobe has now released an emergency hotfix for the flaw, assigned CVE-2026-75650, according to Diamatix. The first recorded exploitation incident dates to 4 September, hitting a server running the latest available security updates, meaning there was no patch to apply and no obvious line of defence.
E-commerce security company Sansec discovered the vulnerability and published its findings, noting that Adobe Enterprise Support had confirmed it was working on a fix. Adobe’s next scheduled security release at the time was 8 September, and the emergency hotfix was issued on 7 September, a day ahead of that schedule.
Who Is Exposed to the StyleSmuggler Magento Zero-Day
The scope is wide. According to Diamatix, Adobe Commerce versions 2.4.4 through 2.4.9 are affected, including their August 2026 releases and earlier versions in those branches. Magento Open Source versions 2.4.6 to 2.4.9 are also in scope, as are Adobe Commerce B2B versions from 1.3.3 to 1.5.3. That covers a substantial proportion of the Magento ecosystem: Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.
The vulnerability abuses Magento’s template system through PHP code injection. The attack generates a fake “failed-payment” email, which in turn triggers code execution on the server. It is a neat abuse of a trusted internal flow, the kind of thing that gets past a cursory review precisely because the email template mechanism is expected to run code.
Inside the Backdoor: Disguise, Persistence and Covert Channels
Successful exploitation drops a small Rust-based backdoor installed as a background process. Early samples disguised themselves as [kworker/u:8:0], a process name that would raise few eyebrows on a busy Linux server. Newer variants copy the binary to ~/.cache/fontconfig/fc-cache and masquerade as fc-cache, the font-cache utility, a similarly unremarkable process name for anyone glancing at a process list.
For persistence, the attacker adds a cron job configured to run every 30 minutes. The backdoor can receive commands from remote infrastructure, and its network traffic has evolved to evade detection. Earlier samples used TLS over WebSockets for command-and-control (C2) communications. Newer versions disguise their traffic as Network Time Protocol (NTP), sending UDP packets to port 123 using hostnames styled to resemble legitimate time-syncing servers. The result: malicious traffic that tends to sail through firewalls that whitelist NTP.
The malware also fingerprints the compromised server’s public IP address by querying services including ipify, icanhazip, ident.me, and ipinfo.io. It checks Linux’s TracerPid value to detect whether it is being traced or analysed. If tracing is active, the malware installs anyway but refrains from beaconing out, a straightforward anti-analysis measure that makes it harder to catch in a sandboxed environment.
Sansec says it did not observe any follow-on activity beyond the installation of the backdoor itself. That does not mean follow-on activity is not happening; it means it was not seen in the incidents Sansec examined.
What Administrators Should Do Right Now
Until the hotfix is applied, Sansec recommends that administrators disable GraphQL as a mitigation measure, since the exploit chain relies on it. Applying the CVE-2026-75650 hotfix from Adobe is the primary remediation step for eligible versions.
For detection, Sansec flags an unexpected surge of Magento “Payment Transaction Failed Reminder” emails as a potential indicator of exploitation. Administrators should also monitor for suspicious kworker or fc-cache processes, unusual cron entries, and temporary files. If compromise is suspected, rotating Magento credentials is advised. The version ranges confirmed by Diamatix, Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, and Adobe Commerce B2B 1.3.3 to 1.5.3, give administrators a clear checklist for assessing exposure before the patch is deployed.
