StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day

1. Executive summary

CVE-2026-75650 ("StyleSmuggler") is a CVSS 10.0 CRITICAL unauthenticated remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, actively exploited in the wild since 4 September 2026 — three days before Adobe shipped Hotfix VULN-39341 on 7 September. The flaw (CWE-1336) lets an unauthenticated attacker inject PHP code through style-related properties in Magento's template engine, which is written to disk and executed when a transactional email template ("Payment Transaction Failed Reminder") is rendered; compromised hosts receive a persistent implant masquerading as a Linux kernel thread. The CVE is not in CISA KEV as of 8 September 2026, and there is no public attribution to a named threat actor. Any EMEA financial services client running an affected Adobe Commerce/Magento storefront — including payment-adjacent e-commerce, member portals or donation platforms — should treat unpatched instances as presumptively compromised given the three-day pre-patch exploitation window, and patch-and-rotate rather than patch-and-forget.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by the specific facts of this item beyond generic patching duties; we do not force a mapping.

3. Technical analysis & attack chain

Affected products and versions (per Tenable/Adobe)

Confirmed attack chain (per Sansec research as reported by Tenable)

1. Initial access — unauthenticated injection. The attacker crafts a payload containing PHP code and injects it through the styles properties within Magento's template system. The injection path sits behind no authentication gate, so no credentials are required, and the technique works regardless of which session storage backend is configured (i.e. session-handler hardening does not mitigate).
2. Payload staging. Magento writes the attacker-controlled content to disk as part of its normal operations — the platform's own file-writing behaviour is the delivery mechanism.
3. Execution. The injected PHP code executes when the platform renders a transactional email template, specifically the "Payment Transaction Failed Reminder" notification. This gives defenders a concrete trigger point: code execution is bound to email-template rendering, not to the initial HTTP request.
4. Persistence — implant deployment. The malware binary is installed at ~/.local/share/.gvfsd/gvfsd-user. It masquerades as a Linux kernel thread using the process name [kworker/u:8:0], and also disguises itself using the process names fc-cache and chronyd (both legitimate system utilities). A cron job restarts the implant every five minutes; later variants changed the cron interval to twice an hour. The malware supports both x86-64 and arm64 architectures.
5. Observed impact. Multiple victim stores confirmed across different attack campaigns; Disrex (an incident response firm) has first-hand experience with at least two compromised stores.

Attribution — unconfirmed. As of 8 September 2026 there is no public attribution linking exploitation to a specific threat actor or group; no actor named in the source material has a MITRE ATT&CK profile in our verified reference data, so attribution must be treated as unconfirmed. Sansec documented at least two distinct operators on the same victim stores: the original group deploying the persistent implant, and a second, unrelated attacker dropping a PHP web shell into the product image cache. Techniques and tooling differ significantly between the two; Sansec treats them as separate campaigns.

Confidence caveat. The full technical chain above (template-engine mechanism, implant path, process masquerade, cron persistence) is single-sourced — it originates from Sansec's research as relayed by Tenable's FAQ, with SecurityWeek and The Hacker News corroborating the headline facts (CVE, CVSS 10.0, active exploitation, 4 September start, 7 September patch) but not the implant internals. The Sansec IoC list itself is referenced but not reproduced in the provided material; verify against Sansec's blog before enforcement.

Historical context. Adobe Commerce/Magento has a sustained exploitation history — three prior CVEs are in CISA KEV: CVE-2025-54236 (CVSS 9.1, KEV 2025-10-24, EPSS 95%, CWE-20, "SessionReaper" account takeover via REST API), CVE-2024-34102 (CVSS 9.8, KEV 2024-07-17, EPSS 100%, CWE-611 XXE, "CosmicSting" RCE) and CVE-2022-24086 (CVSS 9.8, KEV 2022-02-15, EPSS 99%, CWE-20, arbitrary code execution). Any client still carrying these in an internet-facing estate should re-check them in the same sweep.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and patch. Locate all Adobe Commerce (2.4.4–2.4.9), Adobe Commerce B2B (1.3.3–1.5.3) and Magento Open Source (2.4.6–2.4.9) instances, including third-party-operated storefronts. Apply Adobe Hotfix VULN-39341 (security bulletin APSB26-146) to all of them. If an instance cannot be patched immediately, isolate or WAF-block it from the internet.
• Presume compromise for the 4–7 September window. Patching does not remediate an existing compromise. Any store that was live and internet-facing between 4 September (first observed exploitation) and 7 September (hotfix release) requires incident response in addition to the patch. Check specifically for:
• The implant binary at ~/.local/share/.gvfsd/gvfsd-user;
• Processes named [kworker/u:8:0], fc-cache or chronyd running from unexpected locations (a genuine kernel-thread name appearing as a userspace process is itself an anomaly);
• Cron entries restarting a binary every 5 minutes or twice hourly;
• PHP web shells in the product image cache (the second operator's tradecraft).
• Rotate on confirmed compromise. Per Adobe's guidance, rotate the encryption key and all credentials it protects: admin passwords, REST, SOAP and GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH and deploy keys, and extension API keys.

P2 — within 72 hours

• Hunt the email-template execution path. Review transactional email rendering activity — particularly "Payment Transaction Failed Reminder" notifications — for anomalous rendering events or unexpected PHP file writes around template processing, on any instance exposed during the window.
• Verify historical KEV exposure. Confirm CVE-2025-54236, CVE-2024-34102 and CVE-2022-24086 are patched on the same estate; all three are CISA KEV entries with EPSS ≥95% and represent the same attack surface.
• Engage third-party providers. Where storefronts are agency- or provider-operated, obtain written confirmation of hotfix deployment and compromise review (DORA Art. 28).

P3 — within 7 days

• Monitor for KEV listing. CVE-2026-75650 is not in CISA KEV as of 8 September 2026 and has no associated Emergency Directive or Alert; re-check daily, as a KEV addition will harden internal and regulatory justification for emergency patch cycles.
• Track vendor detection coverage. Tenable detection plugins for CVE-2026-75650 are being released on an ongoing basis; confirm scanner coverage is current. No standalone public PoC existed as of 8 September, but assume capability will proliferate.

5. Indicators of compromise

Sansec published an IoC list alongside its StyleSmuggler research, but the indicators are not reproduced in the source material provided for this advisory; the artefacts below are those stated in the Tenable FAQ. Single-sourced (Sansec via Tenable); verify against Sansec's blog before enforcement.

filepath  ~/.local/share/.gvfsd/gvfsd-user
process-name  [kworker/u:8:0]
process-name  fc-cache
process-name  chronyd

Behavioural indicators

6. Detection

rule IMPLANT_StyleSmuggler_gvfsd_user
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero"
        description = "Detects StyleSmuggler persistent implant masquerading as gvfsd-user / kernel thread, dropped via CVE-2026-75650 exploitation of Adobe Commerce / Magento"
    strings:
        $path = ".local/share/.gvfsd/gvfsd-user" ascii
        $kworker = "[kworker/u:8:0]" ascii
        $fcache = "fc-cache" ascii
        $chronyd = "chronyd" ascii
    condition:
        uint32(0) == 0x464c457f and 2 of them
}

Note: the rule keys on the implant's masquerade strings and install path as reported by Sansec via Tenable; the implant binary itself was not available for analysis, so treat as initial coverage and tune against the Sansec IoC list when obtained.

title: Suspicious StyleSmuggler implant masquerade on Linux web server
id: 8f3a2c1e-7b4d-4e69-9a10-2d5c8f7b1a34
status: experimental
description: Detects the StyleSmuggler persistent implant (CVE-2026-75650) masquerading as a kernel thread or system utility, or its cron-based restart mechanism.
references:

    - https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero
author: Adverse Trace
date: 2026/09/08
tags:

    - attack.persistence
    - attack.defense_evasion
    - attack.t1036
logsource:
    product: linux
    service: process_creation
detection:
    selection_procimg:
        Image|endswith:

            - '/.gvfsd/gvfsd-user'
    selection_procname:
        ProcessName|endswith:

            - '/gvfsd-user'
    selection_masquerade:
        CommandLine|contains:

            - '[kworker/u:8:0]'
    filter_legit:
        Image|startswith:

            - '/usr/bin/fc-cache'
            - '/usr/sbin/chronyd'
    condition: (selection_procimg or selection_procname or selection_masquerade) and not filter_legit
falsepositives:

    - Legitimate gvfsd-family processes on desktop Linux systems; verify path and parent process
level: high

CVE assessment

4 referenced CVEs — 3 actively exploited (CISA KEV), 4 critical (CVSS ≥ 9.0)

7. Sources

• Tenable — "StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day" — https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero — 2026-09-08
• The Hacker News — "Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell" — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html — 2026-09
• SecurityWeek — "Adobe Commerce Zero-Day Exploited to Backdoor Online Stores" — https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/ — 2026-09
• Sansec Forensics Team — original StyleSmuggler research (referenced by Tenable; IoC list not reproduced in provided material) — 2026-09-05

8. Adverse Trace position

CVE-2026-75650 is a CVSS 10.0 CRITICAL, unauthenticated, scope-changing RCE with confirmed in-the-wild exploitation since 4 September 2026 — the most severe class of storefront vulnerability we track, and consistent with the Adobe Commerce/Magento platform's KEV history (three prior entries, all EPSS ≥95%). It is not yet in CISA KEV as of 8 September, and attribution is unconfirmed, with Sansec reporting two distinct unattributed operators on the same victims; the implant internals are single-sourced to Sansec and should be verified before enforcement action. For EMEA financial services, the exposure is any customer-facing or payment-adjacent Adobe Commerce/Magento property, including those run by third parties: the three-day pre-patch exploitation window means patching alone is insufficient for anything that was live between 4 and 7 September — those instances need forensic review, the VULN-39341 hotfix, and full credential/encryption-key rotation on any confirmed compromise, with DORA Art. 19 reporting prepared if a major incident is confirmed. We will monitor for CISA KEV addition, a public PoC, attribution updates, and the full Sansec IoC set, and will reissue this advisory if any of those land.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.