Sansec's writeup, published on its own research blog, is unusually specific about why this one is different from the routine drumbeat of e-commerce plugin bugs: the first confirmed victim wasn't running some abandoned extension or a three-year-old core version. It was on Magento 2.4.6-p15, with July and August's security updates applied, and a clean result from Magento's own security:patch-status check. The Hacker News' summary of the disclosure notes Sansec then reproduced the same chain against clean installs of 2.4.7, 2.4.8 and the current 2.4.9 - meaning "we're fully patched" is not, for the moment, a defence against this bug at all.
A form field that becomes a file, that becomes an email, that becomes a shell
The mechanism is what earns the name. Per Sansec's technical detail, an attacker submits a crafted "styles" property through Magento's GraphQL endpoint - no login required - which gets written, unsanitised, into a file Magento generates for itself during ordinary store operation, specifically its payment-failure report. Nobody has to open that report or click anything for the payload to run: Magento's own background job renders a standard payment-failure notification email using that file internally, and rendering it is what executes the smuggled code. A dropper then works through a sequence of PHP execution functions until one isn't blocked, and drops a persistent backdoor compiled as a Rust binary, disguised in the process list as a legitimate kernel thread. It's a chain built entirely out of features the platform is supposed to have - GraphQL input, report generation, transactional email - with no single exotic step, which is part of why a fully patched store didn't stop it.
No CVE, no advisory, and a bulletin date that might not even cover it
As of 6 September, Adobe has issued nothing: no CVE reservation, no security bulletin, no workaround beyond what Sansec has published unilaterally. Adobe's next scheduled Commerce security release lands 8 September - the day after this article - and nobody outside Adobe currently knows whether that release addresses StyleSmuggler at all, or whether it was scheduled before Sansec's disclosure and simply happens to fall a day later. Sansec didn't wait to find out: the firm published its own patch and detection tooling directly, including web-server rules, a CLI guard and a compromise scanner, released publicly on GitHub rather than routed through Adobe's usual bulletin process.
Every current version is in scope
Unlike a lot of Magento-ecosystem flaws, which tend to live in a specific extension or a version range most stores have already left behind, Sansec describes StyleSmuggler as affecting all current versions of Magento Open Source and Adobe Commerce, 2.4.9 included. That breadth is the practical argument for treating this as urgent regardless of patch level, rather than checking a changelog and standing down: the one detail that would normally tell a store operator they're safe - "we're on the latest patched build" - is the one detail this bug specifically doesn't respect.
What to do before Adobe says anything
- Apply Sansec's published web-server rules and CLI guard now rather than waiting for an official Adobe patch, since there is currently no published timeline for one.
- Run Sansec's compromise scanner against every Magento Open Source and Adobe Commerce instance you operate, regardless of how recently it was patched.
- Check the integrity of generated report files and any transactional email templates the platform builds automatically, since the exploit relies on content nobody manually reviews before it runs.
- Watch for Adobe's 8 September bulletin, but don't treat its arrival alone as confirmation this specific bug is covered - verify against the actual advisory text.
- Audit outbound connections from Commerce hosts for unfamiliar processes masquerading as kernel threads, which is how Sansec describes the dropped backdoor hiding in the process list.
Unauthenticated e-commerce RCE with no CVE yet is a pattern we've flagged before it had a catchy name - see our coverage of SAP Commerce Cloud's CVSS 10.0 Data Hub Adapter flaw and the parser-confusion chain behind Rails' KindaRails2Shell. What's unusual here is the gap between "under active attack against fully patched stores" and "vendor has issued literally nothing," which is currently measured in days, not hours. If you run Magento or Adobe Commerce and want a second set of eyes on your exposure before Thursday's bulletin lands, email sales@halfteck.com.