Adobe Addresses Critical Magento Zero-Day Exploit Used for Server Backdooring
Adobe has issued an urgent patch for CVE-2026-75650, a high-severity zero-day flaw identified as StyleSmuggler, which affects multiple Magento and Adobe Commerce versions. Security firm Sansec reported that the vulnerability has been actively exploited since September 4 to install backdoors on affected systems. The malicious payload masqueraded as a standard Network Time Protocol (NTP) server for command-and-control communications, though it left detectable traces through anomalies like \\”Payment Transaction Failed Reminder\\” email activity. The company released a security update to resolve the flaw, which could enable arbitrary code execution if exploited. The advisory confirms the vulnerability is being used in real-world attacks. Affected products include Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, and Magento Open Source 2.4.6 to 2.4.9, covering August 2026 releases and earlier iterations. Adobe designated the fix as a top priority and urges immediate installation of the VULN-39341 hotfix. Post-patch, administrators are advised to activate maintenance mode, pause cron jobs, and regenerate all credentials, including administrator passwords, GraphQL tokens, OAuth secrets, payment gateway APIs, database access keys, SSH credentials, and API tokens. The hotfix has been validated exclusively against August 2026 releases, with compatibility for older versions unconfirmed. Sansec later noted a second threat actor leveraging the same flaw to deploy a 485-byte PHP web shell. This malware gathers system information, verifies write permissions in the pub/media directory, and transmits data via requests to the oast.site subdomain, a domain frequently associated with the Interactsh open-source tool. Given the rising exploitation attempts, organizations are strongly encouraged to apply the hotfix or implement mitigations promptly. Analysis of 338 million simulated attacks revealed that 63% of malicious actions succeed when valid credentials are present. Administrators must prioritize patching to prevent unauthorized access and data exfiltration. The update process requires careful execution to avoid service disruptions, with specific steps outlined in the vendor’s technical documentation. The flaw underscores the risks of unpatched e-commerce platforms, as attackers continue to target critical infrastructure with sophisticated techniques. Enterprises are advised to conduct thorough vulnerability assessments and monitor for signs of compromise, including unusual email patterns and unauthorized file modifications.
Security firm Sansec reported that the vulnerability has been actively exploited since September 4 to install backdoors on affected systems.
Urgent Patch for Critical Vulnerability
The company released a security update to resolve the flaw, which could enable arbitrary code execution if exploited. The advisory confirms the vulnerability is being used in real-world attacks. Affected products include Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, and Magento Open Source 2.4.6 to 2.4.9, covering August 2026 releases and earlier iterations. Adobe designated the fix as a top priority and urges immediate installation of the VULN-39341 hotfix.
Post-Patch Recommendations
Post-patch, administrators are advised to activate maintenance mode, pause cron jobs, and regenerate all credentials, including administrator passwords, GraphQL tokens, OAuth secrets, payment gateway APIs, database access keys, SSH credentials, and API tokens. The hotfix has been validated exclusively against August 2026 releases, with compatibility for older versions unconfirmed.
Second Threat Actor and Malware Analysis
Sansec later noted a second threat actor leveraging the same flaw to deploy a 485-byte PHP web shell. This malware gathers system information, verifies write permissions in the pub/media directory, and transmits data via requests to the oast.site subdomain, a domain frequently associated with the Interactsh open-source tool.
Importance of Immediate Patching
Given the rising exploitation attempts, organizations are strongly encouraged to apply the hotfix or implement mitigations promptly. Analysis of 338 million simulated attacks revealed that 63% of malicious actions succeed when valid credentials are present. Administrators must prioritize patching to prevent unauthorized access and data exfiltration.
Conclusion
The update process requires careful execution to avoid service disruptions, with specific steps outlined in the vendor’s technical documentation. The flaw underscores the risks of unpatched e-commerce platforms, as attackers continue to target critical infrastructure with sophisticated techniques. Enterprises are advised to conduct thorough vulnerability assessments and monitor for signs of compromise, including unusual email patterns and unauthorized file modifications.
About Author
English