OTX Threat: StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

StyleSmuggler is an unpatched zero-day vulnerability affecting all current versions of Magento and Adobe Commerce, including version 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The attack operates in two stages: injecting malicious PHP code through the styles properties to evade safeguards, then executing it via failed payment email temp CVEs: CVE-2025-54236 Sectors: Retail