What Is StyleSmuggler?
StyleSmuggler is a template-injection flaw in Adobe Commerce and Magento Open Source. An attacker can slip instructions into the store's template engine and have the server run their code. They need no admin login. It is rated 10 out of 10, the highest score there is. The name comes from Sansec, the e-commerce security firm that reported the attacks.
It was used as a zero-day: attacks were seen from about 4 September 2026, and stores were left with backdoors. Adobe released an emergency fix, APSB26-146, on 7 September, and CISA added the flaw to its list of exploited flaws the next day.
Am I Affected?
Every Adobe Commerce and Magento Open Source store that hasn't installed APSB26-146 (or a later release that includes it) is affected. That includes Adobe Commerce B2B. Check your version with:
bin/magento --versionThen compare it with the fixed versions in Adobe's bulletin. Each 2.4.x release line has its own patched version.
If you run Magento 1, or a 2.x line Adobe no longer supports, there's no official fix. Move to a supported release.
How to Fix It
- Install the APSB26-146 update for your release line, or Adobe's isolated patch if you can't upgrade yet.
- Clear the caches and recompile:
bin/magento setup:upgrade,bin/magento setup:di:compile,bin/magento cache:flush. - Check the version again.
After Patching: Look for Backdoors
Patching closes the hole but doesn't remove anything that was left behind, and stores were attacked before a fix existed. Check for:
- PHP files you don't recognise under
pub/,pub/media/andapp/; - admin users you didn't create (System › Permissions › All Users);
- changes to CMS blocks, pages and email templates, where injected code often hides;
- new cron jobs, and card-skimming JavaScript on the checkout.
If you find anything, treat the store as compromised: change every admin and database password and the encryption key, and get help cleaning it up.