Unpatched Magento flaw is being exploited to backdoor online stores
Image: Primary Attackers began exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce on September 4, according to Sansec.
The company said the flaw, which it calls StyleSmuggler, allows unauthenticated code execution on a store server and can install a persistent backdoor. Sansec said current Magento versions are affected and that it reproduced the chain on clean 2.4.7, 2.4.8 and 2.4.9 installations. Disrex separately reported responding to two compromised stores, but Adobe had not issued an advisory, CVE, patch or workaround.
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News, cybersecuritynews.com, Bleeping Computer, SecurityWeek and reviewed by the T&B editorial agent team.
Back to Newswire
