6 min read<\/p>\n
CISA added CVE-2026-75650 to its catalog of known exploited vulnerabilities on 8 September 2026. Adobe confirms unauthenticated code execution in Adobe Commerce and Magento Open Source and released emergency hotfix APSB26-146 on 7 September. The patch does not remove existing compromises. September release APSB26-138 does not replace the emergency fix.<\/strong><\/p>\n Key takeaways<\/p>\n Related:<\/strong> CISA lists Ray: browsers launch cluster jobs without login \u00b7 Cyber Resilience Act (CRA) reporting begins: early warning within 24 hours<\/p>\n The United States Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its catalog of known exploited vulnerabilities on 8 September 2026. This Known Exploited Vulnerabilities Catalog (KEV) lists vulnerabilities that attackers are already exploiting. One of the four additions is CVE-2026-75650<\/strong> in Adobe Commerce and Magento Open Source.<\/p>\n CISA describes the vulnerability class as improper neutralization of special elements in a template engine. A template engine generates the store’s HTML pages from templates. Special elements are control characters in these templates that can trigger code execution if the engine fails to neutralize them. The agency announced the addition in a CISA alert dated 8 September 2026<\/a>.<\/p>\n The catalog entry gives the Date Added as 8 September 2026. The Due Date is 11 September 2026. US federal agencies must patch affected installations by that date. CISA also requires a forensic review of affected installations.<\/p>\n CISA lists the vulnerability’s use in ransomware campaigns as unknown. The deadline applies to US federal agencies. The technical vulnerability affects Adobe Commerce and Magento Open Source equally in every country.<\/p>\n Definition · CVE-2026-75650<\/p>\n CVE-2026-75650 is a vulnerability in Adobe Commerce and Magento Open Source. An unauthenticated attacker can execute arbitrary code on the store’s server because the template engine fails to neutralize special elements in templates. Adobe confirms that attackers are already exploiting the vulnerability. CISA has listed it in its catalog of known exploited vulnerabilities since 8 September 2026.<\/p>\n<\/div>\n Adobe states in its Knowledge Base that CVE-2026-75650 is being actively exploited and affects merchants using Adobe Commerce. An unauthenticated attacker can execute arbitrary code on an affected installation, running programs on the store’s server without logging in. The Adobe Knowledge Base article on APSB26-146<\/a> lists its last update as 8 September 2026.<\/p>\n What is APSB26-146?<\/strong> Adobe’s emergency hotfix for CVE-2026-75650, released on 7 September 2026 as VULN-39341. It must be installed in addition to September release APSB26-138 and does not remove existing compromises.<\/p>\n Adobe released emergency hotfix APSB26-146 on 7 September 2026. Sansec puts the release time at 20:20 UTC. Almost three days elapsed between the first confirmed exploitation and this patch, during which affected stores had no vendor fix.<\/p>\n Adobe rates APSB26-146 as Priority 1, its highest level. Sansec uses the same rating. Tenable and Sansec give the vulnerability a Common Vulnerability Scoring System (CVSS) score of 10.0. 10.0 is the highest score on the scale. Both sources describe exploitation without authentication.<\/p>\n Tenable adds that the Scope is changed. This means exploitation can affect resources beyond the vulnerable component. Adobe describes the patch in its Knowledge Base as a critical security update. Sansec provides its assessment in the StyleSmuggler analysis<\/a>, while Tenable covers it in an FAQ on CVE-2026-75650<\/a>. Adobe’s bulletin is available under APSB26-146<\/a>.<\/p>\n Adobe’s Knowledge Base lists the August 2026 releases of the affected product lines.<\/p>\n\n
CISA adds CVE-2026-75650 to the KEV catalog<\/h2>\n
Adobe confirms unauthenticated code execution in stores<\/h2>\n
Adobe limits affected versions to the August 2026 releases<\/h2>\n