Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-75650 Published 2026-09-07 Updated last month Vendor/s Adobe Product/s Commerce and Magento Version/s \* > 2.4.4 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 10 / 10 Critical Severity Details Base score 10 Critical Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description Adobe Commerce and Magento are affected by a CRITICAL (CVSS 10.0) template injection vulnerability allowing unauthenticated arbitrary code execution. ## Why this matters "CVE-2026-75650 is a maximum-severity (CVSS 10.0) vulnerability in Adobe Commerce and Magento that allows for unauthenticated arbitrary code execution. As a template injection flaw, it enables attackers to bypass security boundaries and execute malicious commands directly on the server. This vulnerability is currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating that active exploitation has been observed in the wild. Given the 'Scope Changed' designation, an attacker could potentially pivot from the commerce application to the underlying infrastructure. Security teams must prioritize this update immediately, as it requires no user interaction and poses a severe risk to data integrity and financial transactions." ## CPE Adobe | Product | Version Start | Version End (excl.) | Status | | ------------- | ------------- | ------------------- | ---------- | | commerce | \* | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.4 | 2.4.4 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.5 | 2.4.5 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.6 | 2.4.6 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.7 | 2.4.7 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.8 | 2.4.8 | vulnerable | | commerce | 2.4.9 | 2.4.9 | vulnerable | | commerce | 2.4.9 | 2.4.9 | vulnerable | | commerce | 2.4.9 | 2.4.9 | vulnerable | | commerce | 2.4.9 | 2.4.9 | vulnerable | | commerce | 2.4.9 | 2.4.9 | vulnerable | | commerce\_b2b | \* | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.3 | 1.3.3 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.3.4 | 1.3.4 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.4.2 | 1.4.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.2 | 1.5.2 | vulnerable | | commerce\_b2b | 1.5.3 | 1.5.3 | vulnerable | | commerce\_b2b | 1.5.3 | 1.5.3 | vulnerable | | commerce\_b2b | 1.5.3 | 1.5.3 | vulnerable | | commerce\_b2b | 1.5.3 | 1.5.3 | vulnerable | | commerce\_b2b | 1.5.3 | 1.5.3 | vulnerable | | magento | \* | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.6 | 2.4.6 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.7 | 2.4.7 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.8 | 2.4.8 | vulnerable | | magento | 2.4.9 | 2.4.9 | vulnerable | | magento | 2.4.9 | 2.4.9 | vulnerable | | magento | 2.4.9 | 2.4.9 | vulnerable | | magento | 2.4.9 | 2.4.9 | vulnerable | | magento | 2.4.9 | 2.4.9 | vulnerable | ## Related weakness (CWE) CWE-1336 ## Remediation plan 1 ### Apply official patches Download and install the security updates provided by Adobe in security bulletin APSB26-146. Ensure that all commerce instances, including those using B2B modules, have the latest security hotfixes applied to address the template engine flaw. 2 ### Update affected systems Upgrade Adobe Commerce and Magento Open Source to the latest patched versions. Affected versions include 2.4.4 through 2.4.9; ensure your environment is moved to a version beyond these ranges as specified in the vendor's technical guidance. 3 ### Restrict access Implement strict web application firewall (WAF) rules to filter malicious template directives and suspicious input patterns. Limit administrative access to trusted IP ranges and ensure that the template engine is not exposed to untrusted user input where possible. 4 ### Monitor for exploitation Review web server logs for unusual POST requests or entries containing template syntax like curly braces or object calls. Scan for unauthorized file modifications, new web shells, or unexpected outbound network connections originating from the commerce server. ## Detection Guidance "Detecting exploitation of CVE-2026-75650 requires monitoring for Server-Side Template Injection (SSTI) patterns. Security teams should inspect HTTP request bodies and headers for characters like '{{', '{%', or '${' combined with system-level commands. Monitor access logs for high-frequency requests to commerce endpoints that handle dynamic content. Additionally, utilize File Integrity Monitoring (FIM) to detect the creation of web shells or unauthorized changes to core Magento files following suspicious network activity." ## References [https://helpx.adobe.com/security/products/magento/apsb26-146.html Patch Vendor Advisory ](https://helpx.adobe.com/security/products/magento/apsb26-146.html)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-75650 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)