Zero-Day Vulnerability Actively Exploited in Magento and Adobe Commerce

A new, unpatched zero-day vulnerability, named 'StyleSmuggler,' is being actively exploited in Magento Open Source and Adobe Commerce. This flaw enables attackers to execute malicious code on online store servers without authentication, leading to the installation of persistent backdoors. Sansec discovered the vulnerability and issued an advisory as attacks began on September 4, 2026. Adobe has not yet released a patch or advisory, leaving affected e-commerce platforms vulnerable.