Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-75650 |
| Alert source | CISA KEV - actively exploited vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | Adobe |
| Product | Commerce / Magento (and Commerce B2B) |
| Affected versions | 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9 |
| CVSS Score | 10.0 (Critical) |
| EPSS Score | 0.68% (50th percentile) |
| CISA KEV | Yes |
| CISA deadline | 2026-09-11 |
| Ransomware | Not confirmed |
Vulnerability Description
Adobe Commerce (the platform formerly known as Magento) contains an improper neutralisation of special elements used in its template engine. An attacker able to place their own data where that engine processes it achieves arbitrary code execution in the context of the current application user.
The vulnerability scores 10.0 on CVSS — the maximum. Three properties occur at once:
| Property | Value | What follows from it |
|---|---|---|
| Attack vector | network | HTTP access to the store is enough |
| User interaction | none required | nobody has to click or log in at the wrong moment |
| Scope | changed | impact reaches beyond the component holding the flaw |
The absence of required interaction matters most here. A large share of web application vulnerabilities need an administrator to open a crafted page, or a victim to fall for social engineering. Not this one — the attacker works alone, at machine speed.
The vulnerability is already being exploited. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 11 September 2026.
Why this is particularly serious in e-commerce. An online store is by definition exposed to the public internet, runs continuously, and processes customers’ payment and personal data. Magento’s history shows what exploitation of such a flaw typically looks like: not a spectacular outage, but quiet skimming — an injected script harvesting card details from the payment form, running for weeks before anyone notices. For the store owner the consequence is not only a technical incident but also a personal data breach, with everything that entails.
Required Actions
- Apply the fixes from Adobe bulletin APSB26-146. It lists the exact fixed version numbers for each line — do not base your update plan on version numbers from this alert.
- Treat the deadline as days, not a maintenance window. The CISA deadline is 11 September 2026 and the vulnerability is being exploited. A store does not have the luxury of deferring this to the next quarterly review.
- Reduce exposure before the patch lands. If the update needs time for integration and extension testing, mitigate in the meantime at the layer in front of the application — WAF and reverse proxy rules. This is a stopgap, not a replacement for the patch.
- Review logs for prior compromise. Since the vulnerability is in KEV, the question is not “could someone attack” but “have they already”. Look for unusual requests to endpoints that process templates, new or modified PHP files, unexpected administrative accounts, and changes to the checkout page code.
- Verify the integrity of the payment page. Compare the code loaded in the cart and at checkout against the source version. An injected skimmer is often the only lasting trace of an attack and triggers no performance alarm whatsoever.
- Check third-party extensions and themes. They use the template engine too; patching the core does not close a flaw in an external component that processes user data through its own path.
Who Is Affected?
The vulnerability affects Adobe Commerce and Magento deployments in lines 2.4.4 – 2.4.9 and Adobe Commerce B2B. It covers both self-hosted installations and those run by an external provider — in the latter case, it is worth obtaining written confirmation from them that the patch has been deployed, with a date.
Magento remains one of the more common platforms in mid-size and larger e-commerce, particularly where the store is deeply integrated with ERP and warehouse systems. Such deployments are far harder to update than a default installation, because every core change requires regression testing across the integrations — which is precisely why they most often fall behind on patches.
Sources
- NVD - CVE-2026-75650
- CISA Known Exploited Vulnerabilities Catalog
- Adobe Security Bulletin APSB26-146
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is CVE-2026-75650?
It is an improper neutralisation of special elements used in the Adobe Commerce (formerly Magento) template engine. An attacker can achieve arbitrary code execution in the context of the current application user. It scores 10.0 on CVSS - the maximum - and its scope is marked as changed, meaning the impact reaches beyond the component containing the flaw.
Why does this score 10.0?
Three properties combine: the attack works over the network, it requires no user interaction at all, and it results in code execution with a changed scope. In practice the attacker does not need to talk anyone into clicking or wait for an administrator to act - HTTP access to the store is enough.
Which versions are affected?
Per the CPE data in NVD, the vulnerability covers Adobe Commerce lines 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 and 2.4.9, plus Adobe Commerce B2B. The exact fixed versions are listed in the vendor bulletin APSB26-146 - that bulletin, not this alert, is the authoritative source when planning the update.
What is the CISA deadline?
11 September 2026. The vulnerability is in the Known Exploited Vulnerabilities catalog, meaning its use in attacks has been confirmed. For an internet-facing online store this is a very short window - counted in days, not maintenance cycles.
What if we cannot update immediately?
An e-commerce platform can rarely be taken offline on demand, so the realistic order is: first reduce exposure at the layer in front of the application (WAF, reverse proxy rules), then schedule the update for the earliest possible window, and in parallel review logs for signs of prior compromise. With a KEV-listed vulnerability, assuming the attack has not happened yet requires evidence, not optimism.
