Adobe Commerce and Magento CVE-2026-75650: active exploitation and a separate hotfix

Adobe is warning that CVE-2026-75650 is being exploited against Adobe Commerce and Magento Open Source. The template-engine vulnerability can allow an unauthenticated attacker to execute code remotely. It carries the maximum CVSS 10.0 score, and Adobe assigned the update priority 1.

The operational detail most likely to be missed is that the CVE-2026-75650 hotfix is separate from the September Isolated Patch. Adobe instructs customers to apply the hotfix first, install the relevant September patch afterwards and then rotate the encryption key and associated credentials. “We deployed the September patch” is therefore not evidence that this vulnerability is closed.

Which installations are covered by the warning

Bulletin APSB26-146 lists Adobe Commerce branches 2.4.4 through 2.4.9, Adobe Commerce B2B branches 1.3.3 through 1.5.3 and Magento Open Source branches 2.4.6 through 2.4.9, each with releases described as “2026-aug and earlier”. Adobe’s exact table should drive the decision for an individual installation because delivery of the fix depends on product and version.

The scope includes the relevant Adobe Commerce Cloud and on-premises deployments as well as Magento Open Source. A merchant should inventory more than the primary production instance: include administrative nodes, staging systems, standby origins, container images and old deployments left behind after a migration.

Do not treat a CDN or WAF as the solution. Those layers may reduce some attempts, but the vendor requires an application fix. The public bulletin describes a network vector with low complexity, no account and no user interaction.

How a template flaw becomes code execution

A template system is meant to combine data with a prepared page layout. When attacker-controlled data is instead interpreted as an instruction to the template engine, the boundary between content and executable logic disappears. Adobe classifies CVE-2026-75650 as improper neutralisation of special elements used in a template engine, or CWE-1336.

The public bulletin confirms arbitrary code execution but does not document the complete attack chain. It would be inaccurate to infer that every store is compromised or that every request immediately grants operating-system administrator privileges. Actual impact depends on the application process permissions, access to secrets, segmentation and outbound network access.

Code execution even in a constrained e-commerce process is still serious. The process may reach configuration, databases, payment integrations, fulfilment systems, customer data and the key used to protect other secrets.

The hotfix and September Isolated Patch are separate actions

Adobe’s implementation guidance says the APSB26-146 hotfix is not included in the September Isolated Patch. The recommended sequence is:

1. select the CVE-2026-75650 hotfix for the deployed version;
2. apply it using Adobe’s instructions for Commerce Cloud, on-premises or Magento Open Source;
3. deploy the separate September Isolated Patch;
4. confirm patch state on every active node;
5. rotate the encryption key and every credential that may have been protected by it or exposed through it.

For Adobe Commerce on Cloud infrastructure, the vendor shows how to verify status with the Quality Patches Tool. In other deployment models, evidence should be the applied-patch state, the expected file version or another vendor-supported check — not merely a closed change ticket.

Afterwards, run a transaction test covering login, basket, payment, integrations, webhooks, email delivery and scheduled jobs. An urgent security fix still needs a continuity check.

Rotation goes beyond one encryption key

Adobe recommends rotating the encryption key and all related credentials, including server, API and integration credentials. Its guidance also calls out payment-gateway credentials and system-privileged automation tokens.

Build a dependency inventory before invalidating a key so downstream systems can be updated safely. Prioritise credentials that grant administrative, payment, database, cloud, CI/CD and third-party integration access. Track the owner, rotation time and successful verification for every change.

If the instance was internet-accessible before patching, treat rotation as part of response to a possible incident, not as proof that an incident occurred. Exploitation in the wild raises urgency but does not establish compromise of a particular store.

What to examine after patching

Preserve CDN, WAF, reverse-proxy, application, operating-system, database and administration logs from the exposure period. Look for changes unrelated to approved deployments: new or modified webroot files, scheduled tasks, administrator accounts, integrations, webhooks, API keys and payment configuration.

Compare outbound traffic from the commerce process with its expected profile. An unusual external connection, a child process launched by the application server or an unexplained file change is stronger evidence than a single HTTP error. If compromise is plausible, preserve artifacts before removing them.

Adobe does not provide a universal indicator of compromise or a victim count in the referenced materials. Hunting for web shells, account changes and abnormal egress is Breachroad guidance derived from the code-execution impact, not an official Adobe IOC list.

Source facts and organisational priority

The CVSS 10.0 rating, unauthenticated attack path, arbitrary-code-execution impact, affected product ranges and active exploitation come from Adobe security bulletin APSB26-146. The separate nature of the hotfix and September Isolated Patch, installation order, verification guidance and credential rotation come from Adobe Commerce’s urgent action notice.

For organisations running a storefront, the order is clear: confirm the version, apply both relevant patches, verify every node, rotate credentials and perform triage. We help teams rehearse ownership and escalation through cybersecurity training, while our web and API penetration testing examines application exposure. Our OWASP Top 10 guide for web applications adds context on common vulnerability classes.