Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
-
Attackers are actively exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce, allowing them to execute arbitrary code on affected servers without requiring authentication. Dutch e-commerce security firm Sansec, which discovered the flaw and dubbed it StyleSmuggler, issued an advisory on September 5 after observing the first attacks on September 4.
The zero-day enables remote code execution (RCE) by smuggling malicious payloads through what Sansec describes as a previously unknown attack vector. This allows threat actors to backdoor online stores and potentially steal payment data or compromise the entire infrastructure underlying the e-commerce platform.
- Both Adobe Commerce and Magento Open Source installations are at risk.
- No official patch was available at the time of Sansec's disclosure, leaving stores vulnerable to active exploitation.
- Sansec has stated it is publishing early indicators of compromise and mitigation guidance for merchants.
Given the lack of a vendor-supplied fix, administrators are urged to audit their systems for signs of intrusion immediately and apply any available workarounds provided by security researchers. The exact technical mechanics of the vulnerability have not been fully disclosed to prevent further abuse while the zero-day remains open.
Source: The Hacker News
Is your team already taking steps to trace unauthorized file changes or review server logs for the specific attack patterns Sansec mentioned, or are you waiting for an official patch before intervening?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login