Critical backdoor found in MGT Varnish extension
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08. Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line. | 10.0 | 2% | KEV PoC |
| massroughly 100,000-300,000 internet-facing storefronts |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 54.84.48.253 | e code attempts to restrict access to a single IP address ( 54.84.48.253 ), apparently used by MGT Commerce: console-test.mgt.io fee |
Full article528 words · extracted from sansec.io · click to collapse
| Name | Mgt_Varnish |
| Vulnerable | 1.0.10 and earlier |
| Fixed in | 1.1.0 |
Sansec researchers discovered a critical vulnerability in the popular Varnish module for Magento. This module, developed by MGT Commerce, contains a hidden backdoor that allows remote PHP code execution.
The backdoor was likely inserted to enable remote upgrades and debugging support. However, the protection mechanism can be trivially bypassed and it poses a serious risk to all stores running Mgt_Varnish version 1.0.10 or earlier.
Sansec ran a global Internet scan and found hundreds of vulnerable stores.
How does it work?
The backdoor is located in the feed update controller (Mgt/Varnish/Controller/Feed/Update.php). When activated, it writes attacker-supplied code to a temporary file and executes it as PHP. The code attempts to restrict access to a single IP address (54.84.48.253), apparently used by MGT Commerce:
console-test.mgt.io
feed.mgt-commerce.com
However, there are two flaws in the protection mechanism:
MD5 is unsafe: The "management IP" is hidden using an MD5 hashing function. MD5 has been deprecated since 2004 and can be broken in about 40 seconds using modern hardware.
IP spoofing: The IP check uses
X-Forwarded-Forheaders, which in many configurations can be spoofed by an attacker. This header is typically set by proxies and load balancers, but if not properly validated, an attacker can inject their own value. This effectively allows anyone to execute arbitrary PHP code on the server.
How to check your store
Search for the file Mgt/Varnish/Controller/Feed/Update.php. If it exists and contains md5($remoteAddress) your store is at risk.
The backdoor code has multiple variants with different obfuscation levels, but all versions contain the same vulnerability.
Impact
This vulnerability allows remote code execution (RCE), which means an attacker can:
- Install payment card skimmers to steal customer payment data
- Access and exfiltrate customer databases
- Install persistent backdoors for long-term access
- Modify store functionality or deface the website
- Use the server as part of a botnet or for other malicious activities
Given the critical nature of this vulnerability and the ease of exploitation, all affected stores should be considered potentially compromised.
Recommendations
If you are not using Sansec Shield for active protection of your Magento store, you should:
- Immediately update to Mgt_Varnish version 1.1.0 or later, or replace the module with a high-quality alternative such as Elgentos Varnish Extended.
- Check for signs of a compromise. If you've been running the vulnerable version, assume the worst and audit your server for malicious code
Sansec eComscan detects this backdoor and can help identify if your store has been compromised.
Vendor response
MGT Commerce confirmed the vulnerability and released a fixed version (1.1.0) within two days of being notified. We appreciate their prompt response and cooperation in addressing this critical security issue.
Timeline
| Date | Event |
|---|---|
| 2025-12-09 | Discovery by Sansec, protection added to Sansec Shield |
| 2025-12-10 | MGT Commerce confirms the vulnerability |
| 2025-12-11 | MGT Commerce releases fixed version 1.1.0 |
| 2025-12-15 | Sansec published this warning |
Read more
- Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
- StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
- PolyShell: unrestricted file upload in Magento and Adobe Commerce
- Adobe patches critical Magento admin takeover via menu injection
- CosmicSting attack & defense overview
Text extracted automatically; images, tables and formatting may be missing. Original: https://sansec.io/research/mgt-varnish-critical-vulnerability