CVE-2026-75650: Adobe Commerce RCE Vulnerability

CVE-2026-75650 Overview

CVE-2026-75650 is an unauthenticated remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw stems from improper neutralization of special elements used in a template engine [CWE-1336]. An attacker can send crafted input to a network-facing endpoint and execute arbitrary code in the context of the current user without any authentication or user interaction. The vulnerability carries a maximum CVSS score with a changed scope, meaning exploitation impacts resources beyond the vulnerable component. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild against internet-facing Adobe Commerce and Magento storefronts.

Critical Impact
Unauthenticated attackers can achieve remote code execution on Adobe Commerce and Magento storefronts through server-side template injection, leading to full compromise of e-commerce environments and customer payment data.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch levels)
Adobe Commerce B2B versions 1.3.3 through 1.5.3 (including all patch levels)
Magento Open Source versions 2.4.6 through 2.4.9 (including all patch levels)

Discovery Timeline

2026-09-07 - CVE-2026-75650 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database
2026-09-11 - EPSS score recorded at 2.15% (81st percentile)

Technical Details for CVE-2026-75650

Vulnerability Analysis

CVE-2026-75650 is a server-side template injection (SSTI) vulnerability rooted in the Adobe Commerce template engine. The engine fails to neutralize special syntactic elements in attacker-controlled input before evaluating template expressions. When Adobe Commerce parses a crafted string as a template, the engine treats injected directives as executable code rather than literal data.

The changed scope indicator reflects the architectural reality of Magento deployments. A successful exploit against the storefront process can pivot to underlying database credentials, session stores, admin panels, and payment integrations. This turns a single request into a full-stack compromise of the merchant environment.

The vulnerability requires no privileges, no user interaction, and is reachable over the network, making mass exploitation of exposed storefronts trivial once a working payload is public.

Root Cause

The root cause is classified as [CWE-1336] Improper Neutralization of Special Elements Used in a Template Engine. User-supplied data flows into a template rendering path without sufficient sanitization or context-aware escaping. Directives that should only be resolvable by trusted templates become executable when supplied via HTTP parameters, form fields, or API bodies processed by the affected components.

Attack Vector

Exploitation occurs over HTTP or HTTPS against any internet-exposed Adobe Commerce, Commerce B2B, or Magento Open Source instance. An attacker submits a request containing template directives to a vulnerable endpoint. The template engine evaluates the injected syntax server-side, executing arbitrary PHP or shell commands as the web server user. From that foothold, adversaries commonly deploy web shells, skim payment card data via injected JavaScript (Magecart), and establish persistence in cron jobs or admin accounts.

No verified proof-of-concept code is currently available in public exploit repositories. Refer to the Adobe Magento Security Advisory APSB26-146 for vendor technical details.

Detection Methods for CVE-2026-75650

Indicators of Compromise

Unexpected PHP files written to pub/, var/, or media/ directories on the Magento webroot, particularly with recent modification timestamps
Outbound network connections from the web server process to unfamiliar external IP addresses or command-and-control infrastructure
New or modified administrator accounts in the admin_user table that were not created through legitimate change management
HTTP requests containing template syntax such as {{, }}, #set, or PHP function names in query strings, form fields, or JSON bodies

Detection Strategies

Inspect web server access logs for POST and GET requests containing suspicious template directives targeting checkout, customer, or REST API endpoints
Monitor for php or sh child processes spawned by the PHP-FPM or Nginx worker process, which typically indicates web shell execution
Correlate file integrity monitoring alerts on the Magento application directory against authorized deployment windows
Deploy signatures from the CISA Known Exploited Vulnerabilities Catalog for CVE-2026-75650 across web application firewalls and intrusion detection systems

Monitoring Recommendations

Enable verbose logging on the Magento application layer and forward logs to a centralized SIEM for retention and correlation
Baseline outbound traffic from e-commerce servers and alert on deviations, particularly connections to newly registered domains
Continuously scan customer-facing pages for unauthorized JavaScript modifications that indicate payment card skimmer implants
Track process lineage on Magento hosts and alert when the web server user executes shell utilities, package managers, or scripting interpreters

How to Mitigate CVE-2026-75650

Immediate Actions Required

Apply the security updates referenced in Adobe Security Bulletin APSB26-146 to all Adobe Commerce, Commerce B2B, and Magento Open Source installations without delay
Conduct a compromise assessment on any storefront that was internet-reachable before patching, including review of admin accounts, cron jobs, and file integrity
Rotate all administrator passwords, API keys, integration tokens, and encryption keys stored in app/etc/env.php after patching
Restrict access to the Magento admin panel to trusted IP ranges or place it behind a VPN until patching and forensic review are complete

Patch Information

Adobe released fixed versions and hotfixes documented in the Adobe Magento Security Advisory APSB26-146. Administrators must apply the vendor-supplied patch corresponding to their branch (2.4.4 through 2.4.9 for Commerce and Magento Open Source, 1.3.3 through 1.5.3 for Commerce B2B). Because the vulnerability is on the CISA KEV list, federal agencies must comply with BOD 22-01 remediation timelines.

Workarounds

Deploy web application firewall rules that block request payloads containing template delimiters and known SSTI syntax targeting Magento endpoints
Enforce strict input validation at the reverse proxy for parameters submitted to checkout, customer registration, and REST or GraphQL APIs
Disable or restrict unnecessary Magento modules and third-party extensions that expand the attack surface until patches are deployed
Isolate the Magento application server so that outbound egress is limited to explicitly allowlisted destinations required for payment processing

bash

# Verify installed Magento version before and after patching
php bin/magento --version

# Apply the Adobe security patch via Composer (adjust version to match your branch)
composer require magento/product-community-edition=<patched-version> --no-update
composer update

# Clear caches and recompile after applying the update
php bin/magento cache:flush
php bin/magento setup:upgrade
php bin/magento setup:di:compile