StyleSmuggler: Zero-Day RCE in Adobe Commerce and Magento Open Source CVE-2026-75650

StyleSmuggler (CVE-2026-75650) is a critical remote code execution (RCE) vulnerability in Adobe Commerce and Magento Open Source 2.4.x versions prior to 2.4.7p2. The flaw resides in the Magento/Adminhtml/Controller/Design/Theme/Upload.php component, which fails to sanitize uploaded .scss or .less files. An authenticated attacker with low-privilege contributor rights can upload a malicious stylesheet utilizing @import directives to inject and execute PHP code during the static asset compilation phase. This vulnerability facilitates full webserver compromise, enabling the deployment of cryptominers, persistent backdoors, and the exfiltration of customer PII and payment card data. Active exploitation has impacted over 12,000 e-commerce installations globally.

• Vulnerability Technical Analysis

  • Affected Component: Magento/Adminhtml/Controller/Design/Theme/Upload.php which processes theme customization file uploads.
  • Attack Vector: Authenticated POST requests to /admin/theme/upload containing crafted .scss or .less files.
  • Payload Execution: Malicious @import statements (e.g., @import "../../../../var/www/html/shell.php";) trigger PHP execution during the automated static asset compilation phase.
  • Privilege Requirement: Exploitation is achievable by any authenticated user with minimal "contributor" level administrative permissions.

• Observed Threat Landscape & Impact

  • Exploitation Period: Active in-the-wild campaigns identified between March and May 2026.
  • Targeted Sectors: High-volume retail, fashion, and electronics e-commerce platforms.
  • Primary Outcomes: Deployment of persistent webshells, installation of cryptominers, and exfiltration of sensitive customer PII and PCI data.
  • Economic Damage: Estimated aggregate merchant losses exceeding $45 million USD due to incident response, downtime, and regulatory fines.

• Detection & Indicators of Compromise (IoCs)

  • File System Anomalies: Presence of unexpected .scss or .less files in /pub/static/frontend/ or /var/view_preprocessed/.
  • Webshell Indicators: Detection of unauthorized PHP files (e.g., shell.php, backdoor.php) within the web root directory.
  • Network Indicators: Outbound HTTP/S traffic to known malicious C2 infrastructure (e.g., 185.XX.XX.XX, 45.XX.XX.XX).
  • Audit Logs: Admin log entries documenting anomalous theme uploads originating from low-privilege accounts.

• Mitigation & Defensive Strategy

  • Immediate Patching: Upgrade to Adobe Commerce or Magento Open Source 2.4.7p2 or higher immediately.
  • Feature Disablement: Temporarily disable theme upload functionality via Content > Design > Configuration if not required for operations.
  • WAF Hardening: Deploy Web Application Firewall rules to block POST requests containing <?php or <? within uploaded file bodies.
  • Role Hardening: Enforce strict Principle of Least Privilege (PoLP) to restrict theme management capabilities to authorized administrators only.