Unpatched Magento and Adobe Commerce RCE is already dropping Linux backdoors

Sansec reports an unauthenticated StyleSmuggler chain on current Magento 2.4.x, including stores that already applied July and August 2026 patches. Adobe has not published a CVE or fix as of 7 September.

RWP Ventures · 2026-09-07 · event 2026-09-04 · 5 min read · priority 8.7

This outranks today’s other material developments — including Chromium V8 CVE-2026-85046, already in CISA KEV with a vendor build available, and Magento-adjacent RMM/print-stack issues that already have hotfixes — because store operators currently have no official patch and confirmed implants.

What happened

Sansec’s 5 September advisory, last updated 7 September 13:29 UTC, describes a two-stage chain:

1. Attacker-controlled content is injected into Magento’s template system (Sansec cites styles properties as the evasion path). One observed injector is a generated failure report.
2. Magento then executes the poisoned content while rendering a “Payment Transaction Failed Reminder” email. Nobody has to open the message. Sansec states the attack can succeed even if delivery fails.

Successful exploitation has installed a small Rust implant as a background process. Process names observed by Sansec:

• [kworker/u:8:0] (first wave, 4 September)
• fc-cache, copied toward ~/.cache/fontconfig/fc-cache (6 September, version 2.1.4)
• chronyd (7 September, version 2.1.5)

A 30-minute cron job is used for persistence. On 7 September Sansec also reported a second, unrelated operator dropping a PHP web shell. Independent coverage by BleepingComputer, SecurityWeek, and Heise matches the timeline and the “no vendor patch” status.

RWP is not reproducing request bodies, GraphQL field names beyond what Sansec already published, or a gadget map. Those details are not required to prioritize defense.

Why it matters

Magento remains a high-value payment-adjacent stack. A pre-auth RCE on current patch levels collapses the usual “we are current on Adobe’s calendar” assumption. Payment-card data, admin sessions, stored PII, and downstream marketing integrations sit on the same host as the template engine. A Linux userland implant plus cron is a different problem from a one-shot skimmer: it is persistence and a beachhead for whatever the operator sends next.

The second operator appearing within three days is the usual pattern after a public 0-day in a crowded CMS: the first campaign does not stay exclusive.

Who / what is affected

CONFIRMED by Sansec reproduction: Magento Open Source 2.4.7, 2.4.8, 2.4.9, and at least one 2.4.6-p15 store with July/August 2026 security patches. Adobe Commerce and Adobe Commerce on Cloud are REPORTED as in-scope by researchers and trade press; Adobe has not confirmed edition coverage as of this writing.

Internet-facing Magento GraphQL and checkout/payment email rendering paths are the practical exposure. Sansec’s temporary mitigation if you are not running their commercial shield: disable GraphQL until a vendor fix exists. That is a business-impacting control, not a free lunch — catalog and headless storefronts that depend on GraphQL will break.

Threat / exploitation status

High confidence on existence, exploitation, and patch-gap. Low confidence on scale (Sansec has a large scan net; public counts are not a census).

What defenders should do

Do not wait for 8 September if you run Magento or Adobe Commerce.

1. Treat internet-facing Magento as under active assault. If GraphQL is not a hard business requirement, disable it now, as Sansec recommends, until Adobe ships a fix you can verify.
2. Hunt for the implant names and paths above, unexpected cron every 30 minutes, and new PHP under pub/, var/report/, and mail-template related write locations. Rotate Magento admin, database, Redis, Elasticsearch, and deployment credentials if you have any doubt.
3. Review web logs from 4 September onward for GraphQL posts and failed-payment email generation spikes. Do not treat “we blocked Sansec’s example URI” as coverage; expect variants.
4. If you use a WAF or commercial Magento shield, confirm the vendor has a StyleSmuggler-specific rule, then still hunt. WAF is containment, not a forensic pass.
5. Plan the 8 September Adobe drop as a possible fix, not a promised one. If the bulletin is silent, keep GraphQL off and keep hunting.

This is not a step-by-step exploit guide. If your IR team needs the mechanical walkthrough Sansec already published, use their advisory, not a third-party reconstruction.

RWP assessment

Score 8.7: active exploitation, no vendor patch, payment-adjacent software, confirmed on current releases. It loses a point versus a wormable network appliance 0-day only because exploitation still needs the Magento application surface, not every host on the internet.

CVE-2026-85046 (Chrome V8, CISA KEV 4 September, due 18 September, fixed in 152.0.7977.82) is real and should be in the same patch cycle for endpoints. It is not today’s Daily Top because a patched browser build exists. StyleSmuggler does not.

N-able N-central CVE-2026-86218 (HF4, 6–7 September) is also RMM-critical, but N-able has shipped a hotfix and has not confirmed production exploitation of that specific CVE. Different problem, already has a vendor lever.

What we are watching

• Adobe’s 8 September bulletin: CVE assignment, affected Commerce SKUs, whether cloud is patched by Adobe or remains customer-action.
• Whether CISA adds a Magento CVE to KEV once one exists.
• Implant C2 and whether card-skimming overlays return on the same foothold.
• Copycat operators beyond the two Sansec already separated.