StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.
Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.
- Unauthenticated RCE actively exploited in Magento and Adobe Commerce since at least September 4, 2026.
- Adobe hotfix VULN-39341 (APSB26-146, priority 1) covers 2.4.4-2.4.9; rotate encryption key and all credentials.
- Rust backdoor masquerades as kworker, fc-cache, or chronyd and beacons via fake NTP UDP traffic.
- Scan for compromise before assuming safety; patching does not remove existing backdoors.
- CVEs
- CVE-2026-75650
- Malware
- StyleSmuggler
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 457cfa2fb7p5.daf892t5qau4og8pi4cghbc6fhm1dim3u.oast.site | rameter. Before writing that file, the dropper calls out to 457cfa2fb7p5.daf892t5qau4og8pi4cghbc6fhm1dim3u.oast.site , a subdomain of a public service that developers and teste |
| domain | ntp.timesysnc.net | k like NTP server replies. As of September 7 that name, and ntp.timesysnc.net , both resolve to 185.157.160.251 , which is the address to |
| domain | time.microsft.run | ) ntp.timesysnc.net:123 C2, custom NTP-shaped traffic (UDP) time.microsft.run:123 C2, custom NTP-shaped traffic (UDP) pool.microsft.studi |
| domain | windwsecurity.run | d host # C2 servers 99.84.67.186:443 C2, WebSocket over TLS windwsecurity.run:443 remote shell, WebSocket over TLS (TCP) ntp.timesysnc.ne |
| ipv4 | 182.182.152.48 | ces 88.216.72.181 attacker source, seen at multiple victims 182.182.152.48 attacker source 76.31.99.207 attacker source, failed exploi |
| ipv4 | 185.157.160.251 | tember 7 that name, and ntp.timesysnc.net , both resolve to 185.157.160.251 , which is the address to block if you cannot filter by nam |
| ipv4 | 209.141.43.95 | axfileupload/mag.txt 247.cdnflare.xyz malware download host 209.141.43.95 malware download host # C2 servers 99.84.67.186:443 C2, Web |
| ipv4 | 209.73.130.148 | source 76.31.99.207 attacker source, failed exploit attempt 209.73.130.148 attacker source, successful exploit attempt 77.239.124.107 |
| ipv4 | 76.31.99.207 | ce, seen at multiple victims 182.182.152.48 attacker source 76.31.99.207 attacker source, failed exploit attempt 209.73.130.148 atta |
| ipv4 | 77.239.124.107 | 209.73.130.148 attacker source, successful exploit attempt 77.239.124.107 attacker source, follow-up requests User-Agent: python-requ |
| ipv4 | 88.216.72.181 | llback ntp.syncstime.to:123 C2, fallback # attacker sources 88.216.72.181 attacker source, seen at multiple victims 182.182.152.48 at |
| ipv4 | 99.84.67.186 | launched. This is a small Rust program that connects to the 99.84.67.186 C2 server and waits for commands. So far, we have no indica |
| md5 | fced27f6d57702565353ecc11722533b | /cache/ss_<10hex>/sync_<10hex>.php web shell X-Cache-Token: fced27f6d57702565353ecc11722533b header the web shell requires, 404 without it 457cfa2fb7p5. |
| sha256 | 1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d | a3e82 kworker-linux-arm64 (new build, 209.141.43.95) sha256 1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d chronyd variant, captured from /proc/<pid>/exe /tmp/.kw_<ra |
| sha256 | 4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e | 60e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420 sha256 4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e kworker-linux-x64 (new build, 209.141.43.95), 2270031 bytes |
| sha256 | b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420 | 61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 sha256 b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420 sha256 4352cabaa451e5a894535fbcc4d46628701303322a13745cb547 |
| sha256 | d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82 | -linux-x64 (new build, 209.141.43.95), 2270031 bytes sha256 d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82 kworker-linux-arm64 (new build, 209.141.43.95) sha256 1a337 |
| sha256 | d61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e | d second attacker (unrelated tooling, same victims): sha256 d61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e PHP dropper pub/media/catalog/product/cache/ss_<10hex>/sync |
| sha256 | e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 | n-requests 2.15.0 on the implant operator's requests sha256 e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 sha256 b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4e |
From the original article
9 min read at sansec.io
Developing investigation. Sansec is publishing early because stores are being compromised right now. The threat actors are quickly iterating so we update this article with new indicators as we lear...
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.