A critical zero-day vulnerability affecting Magento and Adobe Commerce, tracked as CVE-2026-75650 and rated CVSS 10.0, has raised serious concerns for e-commerce merchants. The vulnerability, known as "StyleSmuggler," can reportedly allow attackers to compromise store servers without requiring authentication.

Security researchers at Sansec identified the vulnerability and reported active exploitation affecting Magento stores. The flaw is particularly concerning because it affects Magento's core functionality rather than a third-party extension or theme.

What Is the Magento StyleSmuggler Vulnerability?
StyleSmuggler is associated with Magento's GraphQL input handling. According to Sansec's research, the vulnerability can allow an attacker to introduce malicious code through specially crafted requests and potentially execute code on the affected server without logging in.

The reported attack chain involves Magento's existing functionality and can lead to persistent access if an attacker successfully compromises a server. This means that merchants may need to look beyond patching alone and investigate whether a store has already been compromised.

Sansec reported reproducing the unauthenticated attack chain on clean installations of Magento 2.4.7, 2.4.8, and 2.4.9.

Why This Matters for E-Commerce Businesses
A successful server compromise can create risks for store operations, customer information, payment processes, and other business systems. Persistent backdoors may also remain unnoticed after the initial attack.
For this reason, merchants should consider reviewing their Magento environment for indicators of compromise in addition to applying available security updates and patches.

Meetanshi Is Assisting Magento Merchants
Meetanshi, a Magento and Adobe Commerce development agency, is assisting merchants in responding to the StyleSmuggler vulnerability. The company's security work includes applying relevant patches, reviewing servers for potential backdoors or malicious files, and strengthening store security.

Merchants can learn more through Meetanshi's Magento Security Patches Installation service:
https://meetanshi.com/magento-security-patches-installation-service.html

"A patch helps prevent further exploitation, but it may not remove anything that was already introduced into a compromised system," said a Meetanshi spokesperson. "Merchants whose stores were online during the active exploitation period should consider a proper security review rather than relying solely on the installation of a patch."

About Meetanshi Technologies
Meetanshi is a Magento and Shopify development agency headquartered in Bhavnagar, India, with an additional office in Stuttgart, Germany. The company provides e-commerce development, migration, maintenance, extension development, and security services for businesses worldwide.