SECURITYONLINE [.]info reports that attackers are actively exploiting a Magento zero-day, dubbed StyleSmuggler, against Magento Open Source and Adobe Commerce stores. Attacks began on 4 September 2026, with Sansec confirming live exploitation and stating there is no official patch at present. The flaw affects all current Magento versions, including 2.4.9, and researchers have demonstrated exploitation on clean installations, underscoring the severity of the vulnerability.
According to Sansec, the attack chain is a remote code execution (RCE) delivered through Magento’s template system. The attacker injects malicious code into the template rendering process, with two stages: poisoning PHP code (often via a failure report) and then triggering execution as Magento renders the related email content. Crucially, the code runs during template rendering, meaning recipients need not open any emails for the attack to succeed.
Evidence cited includes live campaigns observed on 4 September at 22:40 UTC and successful reproduction on multiple tested environments, including a store running Magento Open Source 2.4.7, 2.4.8, and 2.4.9; a 2.4.6-p15 site with July/August patches also appeared vulnerable.
Practical responses recommended by Sansec include deploying its Shield product to block exploitation in real time, scanning for compromise with eComscan, and temporarily disabling GraphQL until a fix from Adobe is released (expected 8 September, though coverage is unclear). No CVE has yet been assigned to StyleSmuggler.