Posted on

Adobe Commerce / Magento StyleSmuggler CVE-2026-75650 – Actively Exploited Unauthenticated RCE

Threat Overview

Adobe and Sansec have confirmed active exploitation of CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source. Sansec first observed exploitation on September 4, 2026 and named the issue StyleSmuggler. The chain abuses Magento template processing through attacker-controlled style data, plants PHP code in Magento-written content, and then causes Magento to execute the poisoned content while rendering a Payment Transaction Failed Reminder email. No recipient has to open the message. Adobe published hotfix VULN-39341 on September 7 and states that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants.

Post-exploitation has evolved quickly. Sansec observed Rust Linux backdoors masquerading as `[kworker/u:8:0]`, `fc-cache`, and `chronyd`, persistence in cron spool files, WebSocket/TLS C2, and later builds using NTP-shaped UDP/123 traffic. A separate attacker was also observed exploiting the same vulnerable surface to deploy a PHP web shell under the product image cache.

References

Impacted Systems

Vendor/product: Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Deployment model: self-managed/on-premises or hosted merchant deployments running affected application builds. Affected Adobe Commerce versions: 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier, 2.4.5-2026-aug and earlier, and 2.4.4-2026-aug and earlier. Affected Adobe Commerce B2B versions: 1.5.3-2026-aug and earlier, 1.5.2-2026-aug and earlier, 1.4.2-2026-aug and earlier, 1.3.4-2026-aug and earlier, and 1.3.3-2026-aug and earlier. Affected Magento Open Source versions: 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, and 2.4.6-2026-aug and earlier. Attack prerequisite: network reachability to the vulnerable commerce application; authentication is not required. Adobe’s fix is hotfix VULN-39341. Adobe also directs customers to rotate encryption keys after applying the patch.

Why this matters

This is confirmed exploitation of an Internet-facing e-commerce platform with unauthenticated code execution, persistent malware, rapidly changing process names, and multiple observed post-exploitation chains. Patching closes the vulnerable path but does not remove implants placed during the zero-day window.

Criticality: Critical

Exploitation Status

Confirmed active exploitation. Sansec observed exploitation beginning September 4, 2026. Adobe subsequently confirmed that CVE-2026-75650 has been exploited in the wild against Adobe Commerce merchants. Sansec documented multiple backdoor variants and a separate PHP web-shell deployment path on affected stores.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for suspicious GraphQL traffic, published attacker infrastructure, Linux backdoor process masquerading, malicious file creation, cron persistence, NTP-shaped C2, WebSocket/TLS C2, and PHP web-shell creation where the relevant WAF, firewall, DNS, Syslog, or Defender XDR telemetry is ingested.

Required logs

  • Microsoft Defender XDR / Defender for Endpoint: DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents
  • CommonSecurityLog from WAF, reverse proxy, or firewall telemetry with URL/request fields
  • Linux Syslog from Adobe Commerce or Magento servers for cron/process fallback hunting

First Pass – Published StyleSmuggler Process and File Indicators

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("gvfsd-user","fc-cache","chronyd") or ProcessCommandLine has_any ("[kworker/u:8:0]",".local/share/.gvfsd","/tmp/.chrony-","/tmp/.fc-","/tmp/.kw_")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

Published StyleSmuggler Malware Hashes

let StyleSmugglerHashes = dynamic(["e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7","b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420","4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e","d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82","1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d"]);
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (StyleSmugglerHashes)
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

StyleSmuggler Persistence Paths and PHP Web Shells

DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any (".local/share/.gvfsd",".cache/fontconfig","/tmp/.chrony-","/tmp/.fc-","/var/spool/cron","pub/media/catalog/product/cache")
| where FileName in~ ("gvfsd-user","fc-cache","chronyd") or FileName matches regex @"(?i)^sync_[0-9a-f]{10}\.php$" or FileName matches regex @"(?i)^\.gvfsd_[0-9a-f]{8}\.lock$"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Published C2 and Malware Download Infrastructure

let StyleSmugglerIPs = dynamic(["99.84.67.186","185.157.160.251","209.141.43.95"]);
let StyleSmugglerDomains = dynamic(["247.cdnflare.xyz","windwsecurity.run","ntp.timesysnc.net","time.microsft.run","pool.microsft.studio","ntp.timesync.to","ntp.synctime.to","ntp.syncstime.to"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (StyleSmugglerIPs) or RemoteUrl has_any (StyleSmugglerDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| order by TimeGenerated desc

NTP-Shaped C2 From Unexpected Linux Processes

DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort == 123
| where InitiatingProcessFileName in~ ("fc-cache","chronyd","gvfsd-user") or InitiatingProcessCommandLine has_any (".chrony-",".fc-",".gvfsd","[kworker/u:8:0]")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=make_set(RemoteIP,20), RemoteUrls=make_set(RemoteUrl,20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc

Magento GraphQL Requests With Published Attack Markers

CommonSecurityLog
| where TimeGenerated > ago(14d)
| extend Raw=strcat(RequestMethod," ",RequestURL," ",Message," ",AdditionalExtensions)
| where Raw has "/graphql"
| where Raw has_any ("styles[","X-TRACE","X_TRACE_","ss6_457cfa2fb7","Store:")
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceAction, Raw
| order by TimeGenerated desc

Published StyleSmuggler Attacker Source Addresses

let Sources = dynamic(["88.216.72.181","182.182.152.48","76.31.99.207","209.73.130.148","77.239.124.107","5.181.86.133"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where SourceIP in (Sources)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceAction, Message
| order by TimeGenerated desc

Rare Outbound Destinations From Commerce Servers

let CommerceHosts = dynamic(["REPLACE_WITH_MAGENTO_OR_ADOBE_COMMERCE_HOST"]);
let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DeviceName in~ (CommerceHosts)
| summarize by RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where DeviceName in~ (CommerceHosts)
| where (RemoteUrl, RemoteIP) !in (Baseline)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| order by TimeGenerated desc

Linux Syslog Cron and Process Persistence Fallback

Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("gvfsd-user","/tmp/.kw_","/tmp/.fc-","/tmp/.chrony-","fc-cache","chronyd")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated desc

Detection Notes

Highest signal is a published implant path/hash, a non-root `[kworker/u:8:0]`-style process, `fc-cache` or `chronyd` executing from the published hidden paths, or outbound traffic to the published C2 infrastructure. A process named `chronyd` is not inherently suspicious; path, parent process, ownership, and network pattern matter. NTP-shaped C2 can be missed if monitoring excludes UDP/123 or automatically trusts `chronyd`. WAF/CEF field population varies by product, so the GraphQL query may require adapting RequestURL, Message, or AdditionalExtensions parsing. Patching does not remove an already deployed implant.