CVE-2026-75650: Adobe Commerce template engine flaw allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 10, changed scope, and confirmed exploitation per CISA KEV.

What it is

Adobe Commerce, Commerce B2B and Magento are affected by improper neutralization of special elements used in a template engine (CWE-1336), allowing arbitrary code execution in the context of the current user. The flaw is network reachable with no privileges or user interaction required, and the changed scope means impact can extend beyond the vulnerable component. It was added to CISA KEV one day after publication, so treat it as actively exploited.

Impact

An attacker can execute arbitrary code on the affected Commerce or Magento instance, potentially taking full control of the application and its data. Because scope is changed, compromise may extend to other components or the underlying host.

Attack surface

Reached over the network via the template engine processing path, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required, so any internet-exposed instance is directly reachable.

Exploitation

Listed in CISA KEV with a remediation due date of 2026-09-11, indicating known exploitation in the wild; no ransomware campaign use is recorded. EPSS 30-day probability is 0.02148 (81st percentile), which is moderate and secondary to the KEV signal.

What to do

• Apply the vendor patch from Adobe security bulletin apsb26-146 immediately, prioritizing internet-facing Commerce, Commerce B2B and Magento instances.
• If patching cannot be completed within the CISA due date, apply the vendor mitigations or take the instance offline per BOD 26-04 guidance.
• Restrict network access to admin and storefront template-handling endpoints where operationally possible, and block untrusted traffic at the edge.
• Review custom templates, themes and modules for untrusted input reaching the template engine, and remove or sandbox such paths.
• Rotate credentials and secrets stored on or reachable from affected instances after remediation, in case of prior compromise.

Detection

• Hunt web and application logs for template rendering errors, unexpected template file writes, or requests to template-handling endpoints from unusual source IPs.
• Monitor for new or modified files under theme, template and media directories, and for unexpected child processes spawned by the web server or PHP runtime.
• Alert on outbound connections from Commerce or Magento hosts to unfamiliar destinations, which may indicate post-exploitation activity.
• Review authentication and admin activity logs for anomalous sessions or configuration changes around the KEV addition window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.