MODRACXKENNETH D'SILVA

← Blog · Category: Security & Compliance

StyleSmuggler (CVE-2026-75650): The CVSS 10.0 Zero-Click Magento 2 RCE Deep Dive

An exhaustive technical breakdown of StyleSmuggler (CVE-2026-75650), the zero-click CVSS 10.0 RCE in Magento 2 and Adobe Commerce. Exploit mechanics, GraphQL log poisoning, Rust backdoors, and complete forensic remediation.

By Kenneth D'Silva · Published: 2026-09-10 · 6 min read

1. Threat Overview: The CVSS 10.0 Zero-Click Emergency

On September 4, 2026, e-commerce security research firm Sansec detected active in-the-wild zero-day exploitation against production Adobe Commerce and Magento Open Source storefronts. Assigned the identifier CVE-2026-75650 (and tracked under Adobe Security Bulletin APSB26-146), the vulnerability was dubbed StyleSmuggler.

StyleSmuggler is an unauthenticated, zero-click Remote Code Execution (RCE) vulnerability carrying the highest possible severity rating: CVSS 10.0 (Critical). Unlike previous Magento vulnerabilities that required authenticated admin sessions (e.g., CVE-2024-20720) or specific server-side iconv extensions (such as the CosmicSting XXE chain in CVE-2024-34102), StyleSmuggler executes entirely out-of-the-box on default Magento Open Source and Adobe Commerce installations from versions 2.4.4 through 2.4.9, including Adobe Commerce Cloud.

Within 48 hours of initial exploitation, automated attacker infrastructure began weaponizing StyleSmuggler to drop compiled Rust reverse shells disguised as Linux system processes, inject polymorphic Magecart digital credit card skimmers, and maintain rootkits across thousands of merchant servers.

Vulnerability Attribute Specification / Details
CVE Identifier CVE-2026-75650 (Adobe Bulletin APSB26-146)
Common Name StyleSmuggler
CVSS v3.1 Score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected Releases Magento Open Source & Adobe Commerce 2.4.4 to 2.4.9 (and Cloud)
Attack Vector Unauthenticated GraphQL Mutation → Log/Storage Poisoning → Email Template Directive Execution
Primary Post-Exploitation Disguised Rust backdoors ([kworker/u:8:0]), Magecart checkout skimmers, persistent PHP web shells

2. The StyleSmuggler Attack Chain Anatomy

The name StyleSmuggler reflects the core innovation of the exploit: smuggling executable template directives inside customer-facing CSS and styling definition parameters that bypass Magento's strict input sanitation layer.

The complete attack chain operates across four distinct phases:

+-----------------------------------------------------------------------------------+ | StyleSmuggler Exploit Flow | +-----------------------------------------------------------------------------------+ [Step 1: Ingestion & Smuggling] Attacker sends unauthenticated GraphQL mutation targeting Cart / Checkout styling. Malicious PHP template directive is embedded inside unsanitized `styles` payload. │ ▼ [Step 2: Log & Report Poisoning] Input parser treats payload as CSS; unhandled syntax writes verbatim to `var/log/system.log` or temporary payment exception storage. │ ▼ [Step 3: Asynchronous Trigger Event] Attacker forces an automated notification event (e.g. "Payment Failed Reminder" or "Order State Change") that consumes the tainted record. │ ▼ [Step 4: Template Directive RCE] Magento Email Template Filter evaluates the directive stream. Arbitrary PHP code executes in the context of PHP-FPM / `www-data`. +-----------------------------------------------------------------------------------+

Step 1: Payload Smuggling via GraphQL Endpoints

In Magento 2, GraphQL endpoints handle complex checkout customization attributes. When an unauthenticated attacker submits a mutation containing customized styling parameters (e.g., custom theme font definitions or payment method styling overrides), the input validator filters standard HTML tags (<script>, <iframe>). However, because CSS properties allow escaped characters and complex quote encapsulation, template directives (such as {{var ...}} or {{template config_path="..."}}) smuggled inside CSS definitions passed through validation intact.

Step 2: Tainted Log / Exception Storage

When Magento processes the malformed styling input, it logs a non-fatal warning to var/log/system.log or saves an error report under var/report/. Because the raw string containing the smuggled directive was written unencoded, the physical log file on disk now contains an active template execution gadget.

Step 3: Triggering Template Evaluation

The attacker then triggers an automated system notification that references the failed transaction or error context—most notably the Payment Transaction Failed Reminder email. When Magento's Magento\Email\Model\Template\Filter engine parses the email template, it parses the context variables referencing the error data.

Step 4: Arbitrary Remote Code Execution

During variable interpolation, the template filter identifies the smuggled directive from the log/variable record and invokes the underlying PHP method, resulting in arbitrary code execution with the permissions of the web server (www-data or nginx).

3. Post-Exploitation Artifacts Observed in the Wild

Forensic investigations by Sansec and security incident response teams revealed sophisticated post-exploitation tradecraft immediately following StyleSmuggler compromises:

A. Disguised Rust Reverse Shells

Attackers deployed standalone compiled Rust binaries that masquerade as legitimate kernel worker threads or system utilities to evade simple process listing audits:

  • Process name masked as: [kworker/u:8:0] or fc-cache.
  • Binary dropped in volatile directories: /tmp/.systemd-private-* or /dev/shm/.cache/.
  • Behavior: Establishes an encrypted outbound TCP connection to a foreign Command & Control (C2) server, polling for bash commands every 10 seconds.

B. Polymorphic Magecart Skimmers in Database & Layout

Rather than modifying physical core files (which trip file-integrity monitoring), attackers injected obfuscated JavaScript credit card skimmers directly into the Magento database:

-- Example malicious injection target SELECT * FROM core_config_data WHERE path IN ('design/head/includes', 'design/footer/absolute_footer');

The injected scripts dynamically hook into the checkout iframe, harvesting credit card numbers, CVVs, billing addresses, and expiration dates in real time, exfiltrating them via base64 POST requests to lookalike domains.

C. Polyglot PHP Web Shells in Media Uploads

Attackers planted persistent backdoors within product image directories (pub/media/catalog/product/). By prepending valid JPEG/WebP magic bytes (ÿØÿà), the files bypass basic image type checkers while executing PHP if directly requested.

4. Emergency Remediation & Incident Response Runbook

If you maintain Adobe Commerce or Magento Open Source 2.4.4–2.4.9 storefronts, follow this step-by-step containment protocol immediately:

Phase 1: Apply the Official Adobe APSB26-146 Hotfix

Deploy the emergency patch provided by Adobe via Composer:

# Update composer dependencies with the security patch composer update magento/module-email magento/module-graphql --with-dependencies # Compile dependency injection and deploy static content php bin/magento setup:upgrade php bin/magento setup:di:compile php bin/magento setup:static-content:deploy -f php bin/magento cache:flush

Phase 2: Hunt for Active Backdoors & Malicious Processes

Inspect active processes for disguised reverse shells:

# Check for suspicious processes spawned by www-data ps -u www-data -o pid,user,args | grep -E "(kworker|fc-cache|nc|sh|bash|python|perl)" # Inspect active network connections from web workers ss -tulpn | grep -E "(www-data|php-fpm)"

Phase 3: Audit File Integrity & Media Directories

Scan for unauthorized executable files inside media and cache directories:

# Find any PHP/phtml files in pub/media/ find pub/media/ -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -ls # Check for recently modified files in the last 7 days find app/ pub/ static/ -type f -mtime -7 -name "*.php" -ls

Phase 4: Rotate Cryptographic Keys & Passwords

If compromise is suspected, patching alone is insufficient. Rotate all credentials:

  • Magento Crypt Key: Regenerate the encryption key in app/etc/env.php (re-encrypting sensitive data using bin/magento encryption:payment-data:update).
  • Admin Passwords & 2FA Secrets: Force password resets for all administrative accounts.
  • Payment Gateway API Keys: Rotate API keys for Stripe, Braintree, PayPal, and Authorize.Net.
  • Database & Redis Passwords: Rotate database user credentials across MySQL and Redis.

5. Permanent Defense & WAF Rule Hardening

To provide defense-in-depth against future template smuggling vulnerabilities:

1. Block Execution in Media Directories (Nginx)

# Deny execution of scripts in upload directories location ~* ^/(pub/)?media/.*\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$ { deny all; return 404; }

2. Cloudflare / WAF Custom Expression

Block incoming GraphQL requests that carry template directive syntax in unauthenticated headers or parameters:

(http.request.uri.path contains "/graphql" and (http.request.body.raw contains "{{" or http.request.body.raw contains "styles" or http.request.body.raw contains "template")) -> Action: Block

3. Strict Content Security Policy (CSP)

Enforce strict CSP headers to prevent unauthorized digital card skimmers from exfiltrating customer payment data to rogue external domains.

Suggested & Related Reading

Explore related engineering guides from Kenneth D'Silva: