huntrule

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

FreeReviewedSigma · Critical · v2
Category
webserver
Author
HuntRule
Published
2026-09-10
Updated
2026-09-10
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Cisco IOS XE Configuration Change by Web UI WSMA User
Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation
Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)
Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)
Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)
Possible Citrix Bleed Session Token Leak via OpenID Configuration Endpoint (CVE-2023-4966) (via webserver)
Suspicious Citrix StoreFront SAML Test Endpoint Access for XSS (CVE-2023-5914) (via webserver)
Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)
Possible Citrix NetScaler Gateway Buffer Overflow via formssso Endpoint (CVE-2023-3519) (via webserver)
Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)
Pivot detection · T1190 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-09-10
  2. v1
    No changelog recorded for this version.2026-09-10

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.