Fixing and finding
Jump to remediation plan
CVE ID
CVE-2026-75650
Published 2026-09-07
Updated 7 days ago
Vendor/s
Adobe
Product/s
Commerce and Magento
Version/s
* > 2.4.4
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active
exploitation observed in the wild.
CVSS Score (v3.1)
10
/ 10
Critical
Severity Details
Base score
10 Critical
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Description
Adobe Commerce and Magento are affected by a CRITICAL (CVSS 10.0) template injection vulnerability allowing unauthenticated arbitrary code execution.
CPE
Adobe
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| commerce | * | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.4 | 2.4.4 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.5 | 2.4.5 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.6 | 2.4.6 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.7 | 2.4.7 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.8 | 2.4.8 | vulnerable |
| commerce | 2.4.9 | 2.4.9 | vulnerable |
| commerce | 2.4.9 | 2.4.9 | vulnerable |
| commerce | 2.4.9 | 2.4.9 | vulnerable |
| commerce | 2.4.9 | 2.4.9 | vulnerable |
| commerce | 2.4.9 | 2.4.9 | vulnerable |
| commerce_b2b | * | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.3 | 1.3.3 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.3.4 | 1.3.4 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.4.2 | 1.4.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.2 | 1.5.2 | vulnerable |
| commerce_b2b | 1.5.3 | 1.5.3 | vulnerable |
| commerce_b2b | 1.5.3 | 1.5.3 | vulnerable |
| commerce_b2b | 1.5.3 | 1.5.3 | vulnerable |
| commerce_b2b | 1.5.3 | 1.5.3 | vulnerable |
| commerce_b2b | 1.5.3 | 1.5.3 | vulnerable |
| magento | * | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.6 | 2.4.6 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.7 | 2.4.7 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.8 | 2.4.8 | vulnerable |
| magento | 2.4.9 | 2.4.9 | vulnerable |
| magento | 2.4.9 | 2.4.9 | vulnerable |
| magento | 2.4.9 | 2.4.9 | vulnerable |
| magento | 2.4.9 | 2.4.9 | vulnerable |
| magento | 2.4.9 | 2.4.9 | vulnerable |
Related weakness (CWE)
CWE-1336
Remediation plan
1
Apply official patches
Download and install the security updates provided by Adobe in security bulletin APSB26-146. Ensure that all commerce instances, including those using B2B modules, have the latest security hotfixes applied to address the template engine flaw.
2
Update affected systems
Upgrade Adobe Commerce and Magento Open Source to the latest patched versions. Affected versions include 2.4.4 through 2.4.9; ensure your environment is moved to a version beyond these ranges as specified in the vendor's technical guidance.
3
Restrict access
Implement strict web application firewall (WAF) rules to filter malicious template directives and suspicious input patterns. Limit administrative access to trusted IP ranges and ensure that the template engine is not exposed to untrusted user input where possible.
4
Monitor for exploitation
Review web server logs for unusual POST requests or entries containing template syntax like curly braces or object calls. Scan for unauthorized file modifications, new web shells, or unexpected outbound network connections originating from the commerce server.
Detection Guidance
"Detecting exploitation of CVE-2026-75650 requires monitoring for Server-Side Template Injection (SSTI) patterns. Security teams should inspect HTTP request bodies and headers for characters like '{{', '{%', or '${' combined with system-level commands. Monitor access logs for high-frequency requests to commerce endpoints that handle dynamic content. Additionally, utilize File Integrity Monitoring (FIM) to detect the creation of web shells or unauthorized changes to core Magento files following suspicious network activity."
References
Sources
NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)