A zero-day vulnerability nicknamed StyleSmuggler tore through online stores built on Magento Open Source and Adobe Commerce in early September 2026. Dutch e-commerce security firm Sansec first confirmed the flaw at 22:20 UTC on September 4, 2026, after observing a fully up-to-date Magento store compromised with no credentials and no user interaction required. Adobe shipped an emergency fix on September 7, 2026 at 20:20 UTC, formally cataloged as APSB26-146 and assigned CVE-2026-75650 with a maximum CVSS score of 10.0. Adobe’s bulletin confirmed the flaw was already being exploited in the wild by the time the patch shipped, according to The Hacker News.
What makes this Magento zero-day different from the usual patch-Tuesday scramble is who it caught. The first confirmed victim was running Magento 2.4.6-p15 with July and August 2026 security patches fully installed. Being current on updates did nothing to stop it, since the flaw required no authentication and no user interaction at all. For a platform that still processes an estimated $173 billion a year in merchandise volume, that detail alone explains why store operators scrambled to respond in the roughly 70 hours between Sansec’s first confirmed compromise and Adobe’s patch.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is StyleSmuggler and How the Attack Works
StyleSmuggler is a remote code execution bug that requires no authentication at all, meaning an attacker needs nothing more than a network path to a vulnerable store to start an attack. According to CyberSecurityNews and Adobe’s own APSB26-146 bulletin, the flaw spans Magento 2.4.4 through 2.4.9, with Adobe also listing Adobe Commerce B2B versions 1.3.3 through 1.5.3 as affected, and a successful attack hands the intruder code execution on the store’s server. From there, attackers are installing a persistent backdoor rather than simply grabbing data and leaving.
Researchers tracking the exploit have linked it to Magento’s GraphQL layer, the API endpoint that powers modern storefronts and headless commerce integrations. Sansec, the same firm that first mapped the CosmicSting attack wave in 2024, spent the pre-patch window telling clients without its own web application firewall to disable GraphQL entirely until Adobe shipped a fix. That was a blunt instrument. GraphQL underpins checkout flows, product search, and mobile app connections on a lot of stores, so switching it off was a real business cost, not a minor inconvenience, for the two days between Sansec’s advisory and Adobe’s patch.
The name itself is a nod to how the payload gets in. Rather than dropping an obvious file that a scanner would flag, the exploit reportedly smuggles malicious code through style or template-processing logic, letting it blend in with legitimate theme assets. That is consistent with how Magecart-style operators have evolved over the past few years: the goal is not just to get in, but to stay in long enough to skim card data across weeks or months without tripping a standard malware scan.
Timeline: From Silent Compromise to Adobe’s Emergency Patch
The known timeline moved fast once Sansec spotted the first compromise. Adobe’s last routine Commerce bulletin had landed August 11, giving store owners no warning of what was coming. At 22:20 UTC on September 4, 2026, Sansec observed a fully up-to-date Magento store compromised with no credentials and no user interaction, the signal that a live zero-day was in play. The next day, September 5, Sansec reproduced the same attack chain on clean, unmodified 2.4.7, 2.4.8, and 2.4.9 installs to rule out a one-off misconfiguration, then went public with its findings, naming the bug StyleSmuggler and publishing indicators of compromise for administrators to check their own environments against. By the morning of September 6, Adobe still had not responded with a CVE identifier, a patch, or even an acknowledgment, based on reporting from The Hacker News and CyberSecurityNews. That changed on September 7 at 20:20 UTC, when Adobe published security bulletin APSB26-146, assigning CVE-2026-75650, a CVSS 10.0 severity score, and confirming what Sansec had already shown: the flaw was being actively exploited in the wild.
That roughly 70-hour window between the first confirmed compromise and Adobe’s fix was what rattled the Magento ecosystem the most while it lasted. E-commerce sites operate on razor-thin trust margins around checkout, and every hour without an official response was another hour store owners had to decide, largely blind, whether to take GraphQL offline, hire an incident response firm, or just hope they were not one of the early targets. Once APSB26-146 landed, the decision shifted from waiting to patching, but any store compromised during that window still needed a forensic sweep, since a working patch closes the door without evicting an attacker who already has a backdoor installed.
How Many Stores Are Actually Exposed
Sizing the blast radius depends on which tracker you trust, and the numbers vary more than you would expect for a platform this mature. E-commerce analytics firm StoreLeads counted 111,495 active Magento stores in the first quarter of 2026, down from 161,970 in 2021, while broader web-technology crawlers put total Magento and Adobe Commerce usage above 239,000 sites once dormant and low-traffic installs are counted, according to a market breakdown from MGT Commerce.
The store count has been shrinking for years as merchants migrate to Shopify and composable commerce platforms, but raw counts undersell Magento’s footprint. Among the top 1,000 US retailers, Magento and Adobe Commerce still power roughly one in five stores, concentrated in exactly the kind of high-revenue enterprise accounts that attract skimmer gangs and ransomware crews alike.
| Platform | Global market share | Active stores (approx.) | Enterprise position |
|---|---|---|---|
| WooCommerce | ~33.4% | Millions (WordPress-based) | SMB-heavy, fragmented hosting |
| Shopify | ~26.2% | Millions (hosted SaaS) | Growing enterprise share via Shopify Plus |
| Magento / Adobe Commerce | ~7-8% | 111,495 to 239,000+ (est.) | ~20% of top 1,000 US retailers |
Source: MGT Commerce platform tracking, 2026. Figures vary by measurement methodology and should be read as directional rather than exact.
Historical Context: CosmicSting and the Magecart Playbook
Magento has been through this before, and recently. In mid-2024, a bug that came to be called CosmicSting, tracked as CVE-2024-34102 with a maximum-severity CVSS score of 9.8, let attackers steal cryptographic keys straight out of Magento’s configuration files. Chained with a second flaw, CVE-2024-2961, it delivered full remote code execution. Sansec estimated the underlying bug touched 75% of Adobe Commerce and Magento installations worldwide and confirmed 4,275 stores breached in active attacks, including household names like Whirlpool, Ray-Ban, National Geographic, Segway, and Cisco, per Sansec’s research.
What made CosmicSting notable beyond its scale was the aftermath. Sansec ended up tracking seven distinct threat groups exploiting the same hole, competing with each other for control of hijacked stores to run Magecart-style payment-card skimmers at checkout, according to BleepingComputer. That pattern, one disclosure triggering a gold rush among multiple criminal crews, is exactly what security teams braced for again with StyleSmuggler.
StyleSmuggler vs CosmicSting: How the Two Zero-Days Compare
| Detail | StyleSmuggler (2026) | CosmicSting (2024) |
|---|---|---|
| CVE assigned | CVE-2026-75650 (Sept 7, 2026) | CVE-2024-34102 |
| CVSS score | 10.0 (maximum) | 9.8 (critical) |
| Authentication required | None | None (paired with CVE-2024-2961 for RCE) |
| Confirmed breached stores | Under active investigation | 4,275 stores confirmed |
| Attack payload | Persistent backdoor | Key theft, then payment skimmers |
| Patch fully applied stopped it? | No, prior to the Sept 7 patch | Yes, once patched |
The gap in that last row is what worried incident responders most while it lasted. CosmicSting was serious, but patching closed the door. StyleSmuggler compromised a fully updated store, which meant the usual advice, just keep your software current, did not fully apply for the roughly 70 hours before Adobe shipped APSB26-146. On raw severity, StyleSmuggler now edges out CosmicSting: a 10.0 CVSS score is the maximum possible rating on the scale, one notch above CosmicSting’s 9.8, and Adobe’s bulletin confirmed active exploitation at the moment of release.
Adobe’s Patch: What APSB26-146 Covers and Who Still Needs to Act
Adobe’s fix, cataloged as APSB26-146, closes the CVE-2026-75650 hole across the full range of affected releases: Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9, plus Adobe Commerce B2B 1.3.3 through 1.5.3. Adobe’s own bulletin acknowledged active exploitation in the wild at the time of release, which is why the company skipped its normal monthly cadence and pushed the fix out as an emergency, out-of-band bulletin, roughly two days after Sansec’s public disclosure and about 70 hours after the first confirmed compromise.
Applying the patch stops new intrusions through this specific hole, but it does not undo anything an attacker already did during the unpatched window. Because StyleSmuggler’s payload is a persistent backdoor rather than a smash-and-grab data theft, incident responders are treating patching and forensic review as two separate jobs: update to a fixed build first, then separately audit for signs of compromise dating back to September 4, when the first confirmed attack occurred. A store that patches today but skips the backdoor check can still be running attacker-controlled code that arrived before the fix existed. Since every version from 2.4.4 onward, spanning several years of Magento releases, was exposed, the practical guidance from incident responders is to assume compromise is possible on any affected store that was internet-facing between September 4 and September 7, and to verify rather than assume it was not.
Competitive Landscape: Where Magento Stands Against Shopify and WooCommerce
Every major zero-day on Magento reopens the same debate in e-commerce circles: is a self-hosted, highly customizable platform worth the security overhead compared to a locked-down SaaS competitor. Shopify and its Shopify Plus enterprise tier handle patching centrally, so individual merchants are never the ones deciding whether to disable an API layer at 2 a.m. WooCommerce, running on top of WordPress, spreads risk across a huge and fragmented hosting base, which limits any single exploit’s blast radius even when WordPress plugins themselves get hit.
Magento and Adobe Commerce sit in a different spot. Merchants choose it specifically for deep customization and control over checkout logic, inventory, and integrations, features that matter enormously to large retailers with complex catalogs. That same flexibility means every store’s security posture is only as good as its own operations team, and Adobe’s patch cadence becomes a single point of failure shared by every store waiting on the same fix. StyleSmuggler is a reminder that the tradeoff cuts both ways.
Market Impact: What This Means for Adobe and Merchants
Adobe ultimately responded in roughly 70 hours, a window during which a fully patched store was compromised with no fix available. Enterprise software vendors are judged heavily on how fast they respond to active exploitation, and CosmicSting already dented confidence in Adobe Commerce’s security posture two years ago. A second unauthenticated RCE hitting fully patched stores, even with a comparatively quick emergency bulletin, gives procurement teams at large retailers fresh ammunition to question renewal contracts, particularly with a CVSS 10.0 rating attached, the highest severity score the scale allows.
For merchants, the immediate cost was operational. Disabling GraphQL during the two days before the patch broke mobile storefronts, PWA implementations, and modern headless integrations that many enterprise Magento shops built specifically to compete with Shopify’s faster checkout experience. Retailers that chose to ride it out without disabling GraphQL carried a straightforward security risk instead, and either way, the disruption landed during what is, for many verticals, peak pre-holiday planning season, now compounded by the need to patch and audit for compromise at the same time.
There is also a compliance angle that tends to get overlooked in the first 48 hours of a disclosure like this. Any store that processes card payments carries PCI DSS obligations, and a confirmed backdoor on production infrastructure can trigger mandatory forensic reviews, card-brand notifications, and in some cases fines, regardless of whether attackers ultimately reached cardholder data. Legal and compliance teams at affected retailers were likely looped in alongside engineering during that first week, well before Adobe’s September 7 bulletin gave them a CVE number and CVSS score to cite in incident filings.
A Week Stacked With Zero-Days Across the Industry
StyleSmuggler did not surface in isolation. The same week brought a second unauthenticated takeover chain, nicknamed MikroTrick, hitting MikroTik RouterOS devices. CERT Polska coordinated disclosure of six flaws, two of which combine into a full device takeover: CVE-2026-67276, a 9.2-severity bug in how RouterOS validates RSA keys, and CVE-2026-86060, a session privilege escalation flaw. MikroTik shipped fixes on September 3 across versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, but exploitation had already begun a day earlier, per reporting from The Hacker News.
Zoom out further and the pattern holds across the wider stack this quarter. A GitLab flaw scored at CVSS 9.4 was exploited within roughly 48 hours of patches going live. A JFrog Artifactory bug rated CVSS 9.8 saw active exploitation days after disclosure. A separate SAP Commerce Cloud vulnerability hit the maximum CVSS 10.0, forcing SAP to ship 29 separate patches. Add a Chrome V8 zero-day that landed on CISA’s Known Exploited Vulnerabilities list, and the picture is one of infrastructure across the entire software supply chain getting hit faster than vendors can respond.
| Vulnerability | Product | Severity | Patch status (September 2026) |
|---|---|---|---|
| StyleSmuggler (CVE-2026-75650) | Magento / Adobe Commerce | 10.0, unauthenticated RCE | Patched Sept 7 via APSB26-146 |
| MikroTrick (CVE-2026-67276 + CVE-2026-86060) | MikroTik RouterOS | 9.2 | Patched, exploited before fix shipped |
| CVE-2026-19478 | GitLab CE/EE | 9.4 | Patched, exploited within 48 hours |
| CVSS 9.8 flaw | JFrog Artifactory | 9.8 | Patched, exploited within days |
| CVE-2026-58231 | SAP Commerce Cloud | 10.0 | Patched via 29 fixes |
What Security Teams Should Do Right Now
The top priority now is straightforward: apply Adobe’s APSB26-146 patch immediately if it has not already been deployed. For the roughly 70 hours before the fix shipped, Sansec’s guidance was the closest thing to authoritative advice available, and it remains useful as defense-in-depth or for any store that still has not patched. Store operators without Sansec’s own WAF product were advised to temporarily disable the GraphQL endpoint at the web server or CDN layer. A typical Nginx block to shut off the endpoint while leaving the rest of the storefront running looks like this:
location /graphql {
return 403;
}Beyond patching, incident response firms are recommending the same baseline checks that followed CosmicSting, and they apply whether or not a store patched promptly: audit admin user accounts for anything unrecognized, check for unexpected cron jobs or scheduled tasks, review file integrity on core Magento directories, and rotate encryption keys stored in the environment configuration. Teams that already run a structured CISA KEV-driven patch workflow should treat CVE-2026-75650 as a same-day priority now that it carries a CVSS 10.0 score and confirmed in-the-wild exploitation, the same bar that triggers CISA’s Known Exploited Vulnerabilities deadlines for federal agencies.
Predictions: Where This Goes From Here
Some of this has already played out; the rest still looks likely based on how the CosmicSting episode unfolded and how vendors typically respond once a zero-day goes public with active exploitation confirmed.
- Adobe did rush an emergency out-of-band patch, shipping APSB26-146 just two days after Sansec’s public disclosure and roughly 70 hours after the first confirmed compromise, confirming that the reputational stakes of a second high-profile Magento zero-day in two years outweighed waiting for the next scheduled bulletin.
- Expect a rise in confirmed breach disclosures over the following weeks as forensic firms sweep client environments, mirroring the months-long tail of new CosmicSting victims that surfaced well after the initial CVE.
- Multiple criminal groups likely raced to exploit unpatched stores in the roughly 70-hour window before the fix landed, and may still be competing for control of any store that was compromised but not yet cleaned up, the way Sansec observed with the seven CosmicSting-era groups.
- Large retailers running Magento or Adobe Commerce may accelerate evaluations of Shopify Plus or composable commerce alternatives, adding pressure to a store count that has already fallen by roughly a third since 2021.
- Expect continued scrutiny of Adobe’s roughly 70-hour response window and renewed debate over whether that counts as fast for a maximum-severity, actively exploited flaw, given that a fully patched store was compromised before any fix existed.
What This Means for Online Shoppers
Most shoppers will never know which platform powers the checkout page they are typing a card number into, and that is exactly the problem. StyleSmuggler’s payload installs a backdoor rather than an immediately visible defacement, so a compromised store can keep taking orders normally while attackers quietly harvest whatever comes next. Anyone who made a purchase on a mid-size or enterprise online store between September 4 and September 7, 2026, before Adobe’s patch shipped, has reasonable grounds to watch their statements closely and consider a card reissue if anything looks off, particularly on sites they know run on Magento or Adobe Commerce.
Frequently Asked Questions
What is the Magento StyleSmuggler zero-day?
StyleSmuggler is an unauthenticated remote code execution vulnerability affecting Magento Open Source and Adobe Commerce, first confirmed by Sansec on September 4, 2026 and publicly disclosed on September 5. It is now formally tracked as CVE-2026-75650 with a CVSS score of 10.0. It lets an attacker run code on a store’s server and install a persistent backdoor without needing a login.
Is there a patch for the Magento zero-day?
Yes. Adobe released an emergency fix on September 7, 2026 at 20:20 UTC, cataloged as security bulletin APSB26-146 and assigned CVE-2026-75650 with a maximum CVSS score of 10.0. That is roughly 70 hours after Sansec first confirmed active exploitation on September 4. Store operators still running an unpatched, affected version should apply the fix immediately and check for signs of prior compromise.
Which Magento and Adobe Commerce versions are affected?
Adobe’s APSB26-146 bulletin confirms the flaw spans Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9, plus Adobe Commerce B2B 1.3.3 through 1.5.3. The first confirmed victim was running 2.4.6-p15 with all available security patches applied, showing that patch level alone did not protect against it before the fix existed.
How can I protect my Magento store right now?
Apply Adobe’s APSB26-146 patch immediately if it is not already installed. Before the fix was available, Sansec recommended temporarily disabling the Magento GraphQL endpoint for stores that do not run its web application firewall product; that mitigation is still useful as defense-in-depth. Either way, check for unauthorized admin accounts, unexpected cron jobs, and file integrity issues on core directories, since a store compromised before September 7 can still have a backdoor installed even after patching.
How does StyleSmuggler compare to the 2024 CosmicSting attack?
CosmicSting (CVE-2024-34102) carried a CVSS score of 9.8 and led to 4,275 confirmed store breaches, according to Sansec. StyleSmuggler is now tracked as CVE-2026-75650 with a CVSS score of 10.0, technically the higher severity rating of the two, and it shares the same unauthenticated attack profile. Unlike CosmicSting, which stopped once patches were applied, StyleSmuggler compromised at least one fully patched store before Adobe’s fix existed.
How many stores run Magento or Adobe Commerce?
Estimates vary by tracker. StoreLeads counted 111,495 active Magento stores in early 2026, while broader web-technology crawlers cited by MGT Commerce put total usage above 239,000 sites. The platform still powers close to 20% of the top 1,000 US retailers.
Should shoppers worry about buying from Magento-based stores?
The immediate risk is to store operators and their infrastructure rather than a direct threat visible to shoppers, but a compromised checkout page can be used to harvest payment data without obvious signs. Reviewing bank statements after purchases made on any e-commerce site between September 4 and September 7, 2026, before Adobe’s patch shipped, is reasonable practice, especially on stores known to run Magento or Adobe Commerce.
Where can I find official updates on the Adobe Commerce patch?
Adobe published the fix through its Commerce security bulletins as APSB26-146. Store operators should apply that bulletin directly and can monitor Sansec’s research page and industry outlets like The Hacker News for ongoing analysis and any newly disclosed compromise indicators.
Related Coverage
- Chrome Zero-Day CVE-2026-85046 Hits CISA KEV List [2026]
- Medusa Ransomware Hits 500 US Firms, FBI Warns [2026]
- DaVita $15M Settlement Hits 2.4M Dialysis Patients [2026]
- VMware vCenter Bug Hits 361 IPs in 47 Nations [2026]
- CISA KEV Patch Workflow: 12 Steps, 24-Hr Deadline [2026]
