A critical zero-day vulnerability in Adobe Commerce and Magento is currently being exploited to execute unauthenticated remote code and install persistent Linux backdoors. The vulnerability, tracked as CVE-2026-75650 and nicknamed StyleSmuggler, allows attackers to bypass security controls by weaponizing standard e-commerce email templates.
The exploitation chain begins with a specially crafted GraphQL request. Attackers target the styles parameter within the request to inject malicious PHP code. This injection does not execute immediately; instead, it relies on the platform’s internal mail-handling logic. By triggering a “Payment Transaction Failed Reminder” email, the attacker forces the server to process the injected code, leading to full server compromise.
According to researchers at Sansec, the vulnerability affects all current versions of Magento and Adobe Commerce. The sophistication of the attack lies in its ability to bypass traditional web application firewalls that may not be configured to inspect deep GraphQL parameters for PHP syntax, especially when that payload is destined for an email template rather than a direct database query.
Stealthy Linux Backdoor and C2 Communication
Once the PHP code is executed, the attackers deploy a sophisticated Linux backdoor. This malware is designed for long-term persistence and evasion. To avoid detection by network monitoring tools, the backdoor masks its command-and-control (C2) communication as legitimate Network Time Protocol (NTP) traffic.
By utilizing UDP port 123—the standard port for time synchronization—the malware often bypasses egress filtering rules that typically restrict outbound HTTP or HTTPS traffic to unknown IPs. This technique allows the compromised server to receive instructions and exfiltrate data while appearing to perform routine system maintenance tasks.
Mitigation and Patch Status
Adobe is expected to release a formal patch for CVE-2026-75650 during its scheduled security update on September 8, 2026. Until the official fix is applied, security experts recommend that store owners take immediate defensive actions to minimize the attack surface.
The primary recommended mitigation is to temporarily disable GraphQL functionality if the storefront does not strictly require it. However, this may cause significant issues for “headless” commerce installations or Progressive Web Apps (PWAs) that rely on GraphQL for front-end operations. For environments where GraphQL must remain active, administrators should implement strict input validation for the styles parameter and monitor system logs for unusual outbound UDP port 123 traffic originating from the web server.
The emergence of StyleSmuggler follows a trend of template-injection attacks targeting Adobe’s e-commerce platform. Similar to previous vulnerabilities like CosmicSting, this zero-day demonstrates that even if a store has applied recent security updates from earlier in the year, the underlying mechanism of template processing remains a high-value target for automated exploitation.
