A Magento Zero-Day With No Patch and No CVE Is Backdooring Online Stores Right Now, Even the Fully Patched Ones

StyleSmuggler: No Patch, No CVE, Already Backdooring Stores

Start with the sentence that should worry anyone running an online store on Magento or Adobe Commerce right now: there is no patch for this, and the company that found it published anyway, because stores are being compromised while you read this. Dutch e-commerce security firm Sansec disclosed a zero-day it's calling StyleSmuggler on September 5, tracing live exploitation back a full day earlier to September 4. The flaw gives a completely unauthenticated attacker remote code execution on the store's own server, and Sansec was explicit about why it broke from the usual practice of waiting for a full technical writeup before going public: "because stores are being compromised right now."

The scope here is about as bad as it gets for a platform this widely used. Sansec confirmed every current version of Magento Open Source and Adobe Commerce is affected, including the very latest 2.4.9 release, and reproduced the complete unauthenticated attack chain on clean installations of 2.4.7, 2.4.8, and 2.4.9 specifically to rule out any theory that this only hits neglected, outdated stores. It doesn't. The detail that should really change how any store operator reads this: the first confirmed victim was running version 2.4.6-p15 with Adobe's full July and August 2026 security updates applied — the highest patch level Adobe offers for that release line, with a clean security patch-status check beforehand. Being fully current on every previously known Magento vulnerability did nothing to stop this one, because StyleSmuggler doesn't exploit a gap in prior patching; it's a genuinely new vulnerability class nobody had a fix for yet.

The mechanism is worth understanding because it's genuinely clever, and understanding it tells you exactly why "wait for shoppers to report something odd" isn't a viable detection strategy here. StyleSmuggler works in two stages: first, it injects malicious PHP code into Magento's own template system by abusing style properties in a way that slips past the platform's existing content-safety checks. Second — and this is the part worth sitting with — it deliberately triggers Magento's own standard "Payment Transaction Failed Reminder" email, and the poisoned code executes the moment Magento internally renders that email template, not when anyone opens or even receives it. No customer has to click anything. No administrator has to open a suspicious message. The store's own routine, automated payment-failure notification system is the trigger, running entirely inside infrastructure the attacker never had to touch directly. Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and installs a persistent implant that survives on the server going forward.

As of this writing, Adobe has not published a security advisory, assigned a CVE identifier, or shipped a patch or workaround of its own — the company's most recent Commerce security bulletin still dates to August 11, and its next scheduled bulletin is September 8, though there's no confirmation that release will actually address StyleSmuggler. Sansec has also not reproduced the exploit against Adobe Commerce or Adobe Commerce Cloud specifically, and Adobe hasn't clarified which of its own hosted or licensed products are affected — meaning operators on those platforms should treat their exposure as unknown rather than assume they're covered simply because the confirmed reproductions so far have been on Magento Open Source. Independent confirmation of real-world compromise came the same day from Disrex Group, a Magento hosting and development firm, which reported two of its self-hosted client stores compromised and a third targeted but not successfully breached. Sansec's interim guidance for anyone not already running its own protective product is specific and actionable today: temporarily disable Magento's GraphQL functionality until an official fix ships, and check for signs of compromise now rather than waiting for a patch to arrive before looking. If you operate or manage any Magento or Adobe Commerce storefront, this is the rare case where the sensible move is disabling a working feature preemptively, not waiting for confirmation you've been hit.

VMware's VM Escape: Two Critical Sandbox-Breaking Flaws

The second story of the day is a more conventional disclosure, and worth reading partly as a contrast — a critical flaw handled through exactly the responsible channel StyleSmuggler bypassed out of necessity. Broadcom's VMSA-2026-0007 advisory, published September 3, details two vulnerabilities in VMware Workstation and Fusion, the desktop virtualization products a huge number of security researchers, developers, and IT teams rely on specifically because a virtual machine is supposed to be a contained, disposable sandbox. CVE-2026-59346, rated a near-maximum 9.3, is an integer-overflow flaw in the VMXNET3 virtual network adapter: an attacker who already has local administrative privileges inside a guest VM configured with that adapter can trigger the overflow and execute code directly on the host machine — a genuine escape from the sandbox the virtual machine was supposed to provide. The second, CVE-2026-59347, rated 8.1, is a stack-based buffer overflow in the Host-Guest File System component that handles shared folders between a VM and its host, letting an attacker with the same guest-level admin access run code as the host's own VMX process.

Both flaws were reported privately and responsibly — CVE-2026-59346 by researcher h4urek of secsys lab and, independently, by researchers working through Trend Micro's Zero Day Initiative, and CVE-2026-59347 by two researchers at Tencent's Xuanwu Lab — and as of publication there's no evidence either has been exploited in the wild, and neither appears in CISA's Known Exploited Vulnerabilities catalog. That's genuinely good news, and worth stating plainly rather than inflating the urgency: this is a serious, patched vulnerability with no confirmed real-world victims yet, not an active fire. Broadcom's fix ships in version 26H1u1 for both Workstation and Fusion, and there's no official workaround for organizations that can't patch immediately — disabling HGFS shared folders and tightening local admin rights inside guest VMs reduces exposure but doesn't fully close either hole. If your organization uses VMware Workstation or Fusion for malware analysis, sandboxed testing, or any workload where a guest VM might reasonably be compromised or hostile, patching to 26H1u1 is the only complete fix, and it's worth prioritizing precisely because the entire point of using a VM for that kind of work is trusting the sandbox boundary will hold.

Citrix NetScaler: A Three-Week-Old Patch Now Under Active Attack

One more story worth including, since it's genuinely fresh and distinct from a Citrix NetScaler flaw covered on this site back in August. Attackers have begun actively exploiting CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway, after security researcher Ryan Dewhurst of Previdian confirmed exploitation attempts matching a newly published proof-of-concept — his own NetScaler sensor caught requests from three distinct source IPs, geolocated to Australia, the United States, and Germany, within 24 hours of that PoC going public on September 3. This is a different vulnerability from the one covered here at the end of August: that story was about CVE-2026-8452, an RCE and denial-of-service flaw Citrix had originally undersold. CVE-2026-19490, rated 9.3, is a distinct bug entirely — an authentication bypass using an alternate path, letting a remote, unauthenticated attacker skip straight past login controls on appliances configured as a Gateway for SSL VPN, ICA Proxy, Clientless VPN, or RDP Proxy, or as an AAA virtual server. On older builds, any Gateway or AAA configuration is enough to expose the flaw; on NetScaler 14.1-43.56 and later or 13.1-61.28 and later, it's only reachable when a SAML action is configured — a meaningful distinction worth checking against your own specific setup rather than assuming either way. Citrix patched this back on August 19, alongside a related high-severity memory overflow bug, CVE-2026-19489, tied to SIP ALG configurations on Large Scale NAT groups. The fixed versions are 14.1-73.32, 13.1-63.21, and their FIPS and NDcPP equivalents.

Belgium's national cybersecurity authority, the Centre for Cybersecurity Belgium, issued its own warning about active exploitation attempts and urged immediate patching — a genuine echo of the pattern NetScaler appliances have followed repeatedly: CISA has tagged 23 separate Citrix vulnerabilities as exploited in the wild since November 2021, six of which have also been picked up by ransomware gangs specifically. Shadowserver's own internet-wide scanning currently counts more than 22,000 NetScaler ADC instances and roughly 1,700 Gateway instances directly reachable from the public internet, with no visibility into how many of those are honeypots, already patched, or genuinely vulnerable. Citrix hadn't flagged the flaw as actively exploited in its own August 19 advisory — meaning organizations that patched purely because it was the responsible thing to do, rather than because the advisory signaled urgency, made the right call weeks before the urgency became obvious from outside. If NetScaler ADC or Gateway is anywhere in your environment and you haven't yet confirmed you're on 14.1-73.32 or 13.1-63.21 or later, treat that as the most time-sensitive item on today's list — this is now a confirmed, active target, not a theoretical one.

The Common Thread

Three stories, worth reading together specifically because they show what responsible disclosure looks like when it works and what happens when a defender has to skip past it because attackers already didn't wait. Broadcom's VMware flaws went through the process as designed: private research, coordinated fix, patch available before anyone needed to worry about active exploitation. Citrix's NetScaler bypass sits in the middle — patched responsibly back in August, now confirmed under real attack three weeks later, precisely the gap between "patch exists" and "patch applied everywhere" that keeps recurring across this site's coverage. StyleSmuggler didn't get any of that runway — Sansec published incomplete, mid-investigation findings specifically because the alternative was letting stores keep getting backdoored in silence while a fuller writeup got finished. None of the three needed a novel category of vulnerability to matter. They needed the gap between disclosure and universal patching to close faster than it did, and in two of the three cases this week, it didn't.