Thousands of online shops in danger after critical Adobe Commerce/Magento zero-day exploit

Hackers are running a zero-day exploitation campaign targeting online shops that use Adobe Commerce and Magento, a major e-commerce platform. Without any user interaction or privileges, attackers can relatively easily run remote code and take control of the server.

Adobe has issued an “Urgent Action Required” emergency warning to Magento/Adobe Commerce store owners, pressing them to immediately patch a critical zero-day vulnerability.

The bug carries the highest possible severity score, 10 out of 10, and Adobe is already aware that it has been exploited in the wild, targeting merchants.

“The vulnerability could allow an unauthenticated attacker to execute arbitrary code on an affected installation,” Adobe said in an announcement.

According to the security bulletin, the vulnerability affects Magento Open Source, Adobe Commerce B2B, and Adobe Commerce products on all platforms. The company made a hotfix available, not a full release. It has only been tested on software versions released in August, 2026.

Compatibility note warns that the hotfix “may work” on other supported versions, but this has not been officially verified.

“To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys,” Adobe warns.

Adobe’s guidance on applying the patch also reminds admins to have a recent backup before any manipulations.

The advisory urges rotating not only the encryption key, but also all other credentials that may have been locked with it and exposed, including server, API, and integration credentials with third-party service providers.

The platform uses the encryption key to protect integration tokens, payment gateway credentials, and system-privileged automation tokens.

“Rotating the encryption key alone does not invalidate credentials that may already have been exposed. Rotate all associated credentials at their source,” Adobe explains.

Adobe Commerce and Adobe are essentially the same core e-commerce software. Adobe acquired Magento in 2018 and later rebranded the paid commercial versions to Adobe Commerce. It’s one of the major platforms alongside other giants like Shopify and WooCommerce, used by major brands and thousands of smaller shops. Over 150,000 active online stores use Magento.

What is the bug, and how can it be exploited?

The “Improper Neutralization of Special Elements Used in a Template Engine” vulnerability is tracked as CVE-2026-7565.

It was first discovered and disclosed by Sansec, a cybersecurity company that specializes in protecting online stores and e-commerce platforms.

“Attacks started September 4th,” the Sansec Forensics Team warned in its research.

“Every version from 2.4.4 up to and including 2.4.9 is affected.”

The company chose to publish the report early due to ongoing compromises of online stores.

“The threat actors are quickly iterating,” Sansec warned.

Initially, on compromised servers, attackers left a background process – a small Rust program that connects to a specific command and control server and waits for additional commands. Several other variants created by different attackers have since been observed in the wild.

The exploit, dubbed StyleSmuggler, injects malicious PHP code into Magento’s template system.

It evades safeguards by using styles properties, and works in 2 stages:

1. Inject (poison) PHP code for later use, for example, by generating a failure report.
2. Trigger Magento into executing the poisoned code.

The researchers found that one way to trigger the attack is by using Magento’s standard “Payment Transaction Failed Reminder” email.

“Unexpected bursts of these messages are a reason to investigate, although legitimate declined payments can generate the same notification,” the report reads.

Opening the poisoned email is not required – the malicious code runs while Magento prepares (renders) it, and the attack can succeed even if email delivery fails.

The attacker gains code execution in the current user's context with privileges already granted to the vulnerable application on the server.

Researchers recommend scanning the entire system for potential implants and any secondary backdoors.

In previous attacks, the malware tried to appear legitimate by using processes named kworker, fc-cache, or chronyd, as well as C2 servers that mimicked Microsoft, timesync, and other domains.