logo

StyleSmuggler fix: patch the Magento and Adobe Commerce RCE

ID: 0cb2b82a-da85-5aed-b7c1-e2561d8f7047

STIX ID: report--0cb2b82a-da85-5aed-b7c1-e2561d8f7047

Feed Name: Aikido Security's Blog

Threat Score
95/100

Date Published: 2026-09-07

Date Updated: 2026-10-13

...
...

StyleSmuggler is a critical zero-day RCE affecting all current Magento Open Source and Adobe Commerce releases, actively exploited since September 4, 2026; attackers inject PHP via GraphQL style properties that later execute during email template rendering, enabling installation of a persistent Rust-based backdoor. Aikido has released drop-in library patches and detection intelligence, Adobe had not yet published a patch or CVE at the time of the report, and temporary mitigation includes disabling GraphQL and rotating credentials if compromise is detected.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.