A new zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited in the wild — and there is no patch yet. Dutch e-commerce security firm Sansec, which discovered the flaw and named it StyleSmuggler, published an advisory on Saturday after observing attacks beginning on September 4. That gives defenders essentially zero lead time.

The vulnerability allows an unauthenticated attacker — someone with no login credentials whatsoever — to execute arbitrary code on the web server hosting the store. In plain terms: an attacker can walk in through the front door, go wherever they like, and install whatever they want. Sansec says the exploitation is already resulting in backdoors being planted on affected stores.

Why this one matters more than most.

Magento and Adobe Commerce together power a significant chunk of the world's mid-market e-commerce. They're particularly popular among retailers that need flexibility beyond Shopify but can't afford a bespoke build. That means the blast radius here is wide — and the targets are attractive. Online stores hold payment card data, customer PII, and order histories. A backdoor in this environment is a skimmer waiting to happen.

The StyleSmuggler name is a nod to the attack vector: the flaw lives in how the platform handles certain stylesheet-related requests. The specifics of the exploitation chain haven't been fully disclosed — Sansec is deliberately holding back technical details to limit copycat attacks while a patch is in development — but enough is known for defenders to act.

What you should do right now.

If you run a Magento or Adobe Commerce store, the immediate priority is detection, not a patch (because there isn't one yet). Sansec recommends scanning for unexpected PHP files in the web root, checking for new or modified admin accounts, and reviewing web server logs for unusual POST requests to stylesheet-related endpoints. Web application firewall rules targeting the known request patterns are a viable short-term mitigation.

Adobe has acknowledged the issue and says a patch is in development. No timeline has been given publicly.

The Australian angle is real here. Magento is among the most widely deployed e-commerce platforms in Australia, used by thousands of small and mid-sized retailers. A backdoor that enables card skimming would trigger notification obligations under the Privacy Act's Notifiable Data Breaches scheme, and affected businesses with annual turnover above certain thresholds could also face scrutiny under OAIC guidelines. If you manage Australian e-commerce infrastructure, this is a weekend-grade incident response priority.

What to watch. The window between a zero-day's public disclosure and widespread exploitation is shrinking — here it appears to have already closed. The key question now is how long Adobe takes to ship a patch, and whether Sansec's decision to publish early (before a fix exists) accelerates or merely meets the attack curve. Early disclosure of active exploitation is defensible; the alternative is leaving store operators in the dark while attackers already have the keys.