Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Cisco IOS XE Configuration Change by Web UI WSMA User

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

Possible Citrix Bleed Session Token Leak via OpenID Configuration Endpoint (CVE-2023-4966) (via webserver)

Suspicious Citrix StoreFront SAML Test Endpoint Access for XSS (CVE-2023-5914) (via webserver)

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

Possible Citrix NetScaler Gateway Buffer Overflow via formssso Endpoint (CVE-2023-3519) (via webserver)

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Pivot detection · T1190 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-09-10
v1
No changelog recorded for this version.2026-09-10

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

potential-stylesmuggler-cve-2026-75650-exploitation-attempt-magento-graphql-styl-4960108b

title: Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)
id: f200e83a-db21-44d7-93ab-180edd494dc1
status: stable
description: |
  Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern
  reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution
  vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an
  exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.
references:
  - https://sansec.io/research/stylesmuggler-0day
  - https://helpx.adobe.com/security/products/magento/apsb26-146.html
author: HuntRule Team
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-75650
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith:
      - '/graphql'
      - '/graphql/'
    cs-uri-query|contains:
      - 'styles['
      - 'styles%5B'
      - 'styles%5b'
  condition: selection
falsepositives:
  - Unknown
level: critical

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL