Excerpt:
A critical Magento vulnerability known as StyleSmuggler (CVE-2026-75650) is being actively exploited. One unusual indicator is a burst of Magento “Payment Transaction Failed” emails. Magento merchants should patch immediately and check their servers for signs of compromise.

A Critical Magento Vulnerability Is Being Actively Exploited

A critical security vulnerability affecting Magento Open Source and Adobe Commerce is currently being exploited against live ecommerce stores.

Known as StyleSmuggler and tracked as CVE-2026-75650, the vulnerability allows an unauthenticated attacker to potentially achieve remote code execution on a vulnerable Magento installation.

Sansec discovered the attack campaign on September 4, 2026. Adobe subsequently released an emergency hotfix on September 7. The vulnerability received the maximum CVSS score of 10.0. Sansec reports that Magento versions from the affected 2.4.x branches are vulnerable and that attackers have continued changing their payloads during the campaign.

Why “Payment Transaction Failed” Emails Matter

One of the most unusual characteristics of StyleSmuggler is its relationship with Magento’s normal failed-payment email process.

According to Sansec, the attack works in two stages. First, malicious code is introduced into data that Magento may later process. The attacker then causes Magento to process the poisoned data through mechanisms that can include rendering a Payment Transaction Failed Reminder email.

This means an unexpected increase in emails such as:

Payment Transaction Failed

or

Payment Transaction Failed Reminder

should be investigated.

Warning signs may include:

  • Orders or checkout attempts with a $0.00 total
  • Guest customers with obviously fake information
  • Empty Payment Method or Shipping Method
  • Incomplete billing or shipping addresses
  • Raw Magento template syntax such as {{var ...}} or {{depend ...}}
  • Multiple failed-payment emails appearing within a short period

A normal declined credit card can still generate the same Magento email, so receiving one failed-payment notification does not automatically mean the store was compromised.

However, Sansec specifically warns that unexpected bursts of these notifications are a reason to investigate. The malicious code can execute while Magento renders the email; the recipient does not need to open it, and the attack may still succeed even when email delivery itself fails.

How StyleSmuggler Attacks Magento

StyleSmuggler targets Magento's template processing system and can abuse properties such as styles to bypass existing protections.

Researchers have observed malicious requests involving Magento's GraphQL endpoint, including requests such as:

 
POST /graphql
 

and variants containing attacker-controlled parameters or headers.

Sansec has reproduced the full unauthenticated attack chain on clean Magento Open Source installations and has observed active probing against production stores.

Because the attackers are changing their payloads frequently, simply blocking one exact URL or payload is not sufficient as a permanent solution.

Adobe Has Released an Emergency Hotfix

Adobe has released the dedicated hotfix:

 
VULN-39341
 

for:

 
CVE-2026-75650
 

Sansec recommends that merchants apply this patch immediately. Importantly, this fix was distributed as a hotfix rather than a normal Magento release, so being on a relatively recent Magento patch level does not necessarily mean the store is protected.

Magento store owners should verify that the hotfix has actually been applied rather than assuming their regular Magento upgrade already contains it.

Patching Is Only the First Step

Applying the Adobe patch closes the vulnerability, but it does not remove malware or backdoors if a store was successfully compromised before the patch was installed.

Sansec recommends four primary actions:

  1. Apply Adobe's VULN-39341 hotfix.
  2. Block ongoing StyleSmuggler attacks.
  3. Scan the server for compromise and secondary backdoors.
  4. Rotate potentially exposed credentials.

This distinction is important because stores were being exploited before Adobe's emergency hotfix became available.

Indicators Magento Store Owners Should Check

Sansec has observed malicious processes disguised under names that resemble legitimate Linux system processes, including:

 
[kworker/u:8:0]
fc-cache
chronyd
 

Some variants establish persistence through cron jobs, while others can relaunch themselves without cron persistence.

Researchers have also observed PHP web shells being written under Magento's writable media directories, including paths resembling:

 
pub/media/catalog/product/cache/ss_*/sync_*.php
 

Other warning signs can include:

  • Unexpected executable files under /tmp
  • Unknown cron entries
  • Suspicious PHP files inside pub/media
  • Unusual outbound connections
  • Unexpected GraphQL POST traffic
  • PHP code appearing inside Magento logs
  • Recently modified files that were not part of a deployment

Sansec publishes and continues to update a detailed list of indicators of compromise as the campaign develops.

Should You Disable Payment Failed Emails?

Temporarily disabling Payment Failed Email notifications may reduce inbox spam, but it does not fix the vulnerability.

The correct security approach is:

 
Patch
→ Scan for compromise
→ Block malicious traffic
→ Rotate credentials
→ Verify checkout and payment functionality
 

After the security issue has been addressed, additional protection can be added through:

  • Magento checkout reCAPTCHA
  • Web Application Firewall rules
  • GraphQL filtering
  • Rate limiting
  • Checkout bot protection
  • Monitoring suspicious failed-payment attempts

Payment Failed Email suppression should only be considered a temporary operational measure.

Credential Rotation Is Important

Adobe recommends credential rotation because an attacker who successfully exploited the vulnerability may already have obtained sensitive information.

Depending on the store, this can include:

  • Magento administrator passwords
  • Magento encryption keys
  • REST, SOAP and GraphQL integration tokens
  • OAuth secrets
  • Payment gateway credentials
  • Database passwords
  • SSH and deployment credentials
  • Third-party API keys

Changing only the Magento encryption key is not sufficient if credentials were already exposed to an attacker.

What Magento Merchants Should Do Now

If you operate a Magento or Adobe Commerce store, do not wait for visible storefront problems before investigating.

A store can appear completely normal while an attacker is probing GraphQL, poisoning application data or installing persistence in the background.

If you are receiving unusual Payment Transaction Failed emails, particularly messages containing $0 transactions, fake guest details or malformed address information, you should review the server logs and Magento security status immediately.

For the detailed technical research and continuously updated indicators, see:

Sansec: StyleSmuggler Magento and Adobe Commerce 0-day RCE

Need Help Securing Your Magento Store?

If you are unsure whether your Magento store has been patched correctly, are receiving suspicious Payment Failed emails, or want to check whether your server has already been targeted, MageHQ can help.

Our Magento security remediation service can include:

  • CVE-2026-75650 / VULN-39341 patching
  • Magento security update verification
  • StyleSmuggler IOC and malware scanning
  • Apache / GraphQL attack mitigation
  • Checkout and payment bot protection
  • Log and suspicious-request analysis
  • Credential rotation guidance
  • Magento checkout regression testing
  • Post-remediation security verification

Contact MageHQ for assistance:

Contact MageHQ