Zero-Day Security Vulnerability Exploited in Magento

Attackers are exploiting a new, unpatched security vulnerability in Magento Open Source and Adobe Commerce that allows them to execute malicious code on the servers of online shops without logging in. This was announced by the Dutch e-commerce security firm Sansec in a statement released on September 5. The attacks began on September 4.

Sansec has dubbed the vulnerability StyleSmuggler. This security flaw enables attackers to take control of affected systems, posing significant security risks for online merchants. The exact technical exploitation of the vulnerability has been detailed by Sansec to assist affected companies in protecting themselves. The vulnerability affects both the open-source version of Magento and the commercial version of Adobe Commerce. Sansec has noted that the attacks are specifically targeting online shops using this software.

The security firm has already recommended measures to secure systems and minimize potential damage. Affected companies are urged to review their systems immediately and implement security updates as soon as they become available. Sansec has pointed out that attackers can exploit the vulnerability without requiring authentication, significantly increasing the threat level. The discovery of the vulnerability and the subsequent attacks have drawn the attention of the security community. Experts warn that online merchants using Magento or Adobe Commerce are particularly vulnerable if they do not take immediate action.

The security firm has already published initial analyses of the attack patterns. Sansec has also indicated that the attacks could occur in multiple waves, meaning that the threat is not just temporary. The security firm has urged affected companies to review and potentially strengthen their security protocols to prevent future attacks. The vulnerability could have far-reaching implications for the e-commerce sector, especially at a time when many businesses rely on online sales. Sansec has already released a list of measures that companies should take to protect their systems.

The exact CVE number for this vulnerability has not yet been published, as the flaw continues to be actively exploited. However, Sansec has emphasized that they are working closely with affected companies to assess the situation and find solutions. The vulnerability could potentially affect thousands of online shops that rely on Magento and Adobe Commerce. Sansec has already released initial estimates suggesting that the number of affected systems could continue to rise in the coming days. The security firm plans to publish further information and updates as new insights become available.

Companies should regularly stay informed about the latest developments and ensure that their systems are up to date. Sansec published a comprehensive analysis of the attacks targeting the vulnerability on September 5, 2026. The security firm has stressed that a rapid response is crucial to minimize the impact of the attacks. The vulnerability has been classified as critical, and companies should take all necessary steps to protect their systems.

Sansec has already released a series of recommendations to help companies prepare against this threat. The discovery of the vulnerability and the subsequent attacks highlight the need for a proactive security strategy in the e-commerce sector. Companies should ensure they have the latest security updates and regularly check their systems for vulnerabilities. The security firm Sansec has emphasized that the attacks on Magento and Adobe Commerce represent a serious threat to the online retail landscape.

Companies should be aware of the risks and take appropriate measures to protect their systems. The vulnerability was made public by Sansec on September 5, 2026, after the first attacks were detected on September 4.