CVE-2026-75650 is a template-engine code-injection flaw (CWE-1336) in Adobe Commerce, Commerce B2B and Magento Open Source that lets an attacker execute arbitrary code with no user interaction required and a CVSS scope change, carries the maximum possible CVSS v3.1 base score of 10.0, and is listed in the CISA KEV catalog with a 3-day remediation deadline and mandatory forensic triage.
Vulnerability summary
10
Critical
3.9%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-09-07
Published
Vulnerability ID: CVE-2026-75650 · Source: Adobe (PSIRT Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Adobe Commerce | cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* | Before 2.4.4, and every tracked patch level from 2.4.4 through 2.4.9-beta1 is separately listed as vulnerable in NVD's configuration data — i.e. all actively-tracked Commerce releases as of publication |
| Adobe Commerce B2B | cpe:2.3:a:adobe:commerce_b2b:*:-:*:*:*:*:*:* | Before 1.3.3, and every tracked patch level from 1.3.3 through 1.5.3-beta1 is separately listed as vulnerable |
| Magento Open Source | cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* | Before 2.4.6, and every tracked patch level from 2.4.6 through 2.4.9-beta1 is separately listed as vulnerable |
What this means
CVE-2026-75650 is an improper neutralization of special elements used in a template engine (CWE-1336) affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source. NVD's description states: "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed" (NVD).
NVD lists only a Secondary CVSS submission from Adobe's own PSIRT (source [email protected]): CVSS v3.1 10.0, the maximum possible base score, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, a changed scope (meaning the vulnerable component can affect resources beyond its own security scope), and high impact across confidentiality, integrity and availability. NVD's own vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published for this CVE as of this run, so per our indexing policy the 10.0 figure is labelled not NVD-confirmed and attributed to Adobe's PSIRT rather than NVD itself (NVD).
NVD's configuration data is unusually broad for this CVE: rather than a single "before version X" cutoff, it separately lists essentially every tracked patch level of Adobe Commerce (2.4.4 through the 2.4.9 beta line), Adobe Commerce B2B (1.3.3 through 1.5.3 beta) and Magento Open Source (2.4.6 through 2.4.9 beta1) as vulnerable, alongside catch-all "before 2.4.4" / "before 1.3.3" / "before 2.4.6" ranges — indicating the flaw spans effectively all currently-supported release lines rather than a narrow version window (NVD). Adobe's own security bulletin APSB26-146 is listed by NVD as the vendor patch advisory, but it returned an access-restricted response when fetched directly for this page and so is cited here as a pointer rather than quoted; operators should consult it directly for the specific patch or hotfix identifier to apply to their branch (Adobe Security Bulletin APSB26-146).
CISA added CVE-2026-75650 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-08, with a required-action due date of 2026-09-11 (a 3-day window), and flagged it for mandatory forensic triage under CISA's directive guidance — both consistent with active exploitation of a maximum-severity, unauthenticated code-execution flaw on internet-facing e-commerce storefronts. Known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.03949 (90.401th percentile) (FIRST EPSS).
Given the maximum CVSS score, the no-user-interaction exploitation path, and CISA's short deadline with mandatory forensic triage, any Commerce, Commerce B2B or Magento Open Source storefront should apply Adobe's APSB26-146 patch immediately and treat any internet-facing instance that was running a vulnerable build as a potential compromise requiring investigation rather than a simple patch-and-move-on.
Evidence
- Improper neutralization of special elements used in a template engine could result in arbitrary code execution; exploitation does not require user interaction; scope is changed. — NVD
- Only a Secondary CVSS v3.1 score of 10.0 (maximum) from Adobe's own PSIRT is published; no NVD Primary metric exists as of this run. — NVD
- NVD configuration data lists essentially all currently-supported patch levels of Adobe Commerce, Commerce B2B and Magento Open Source as vulnerable, rather than a single narrow version cutoff. — NVD
- Added to the CISA KEV catalog on 2026-09-08, due date 2026-09-11, with mandatory forensic triage flagged; known ransomware-campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.03949 (90.401th percentile) as of 2026-10-30. — FIRST EPSS
