CVE-2026-75650: listed in the CISA KEV catalog CVE-2026-75650 · CVSS 10.0 CRITICAL · EPSS 4% · KEV 2026-09-08 · patch available
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Is CVE-2026-75650 exploited? Listed in the CISA KEV catalog on 2026-09-08. Federal remediation due 2026-09-11. Past that date by 48 days. EPSS puts exploitation in the next 30 days at 4%. Public exploit code: none found in monitored sources. Which products and versions are affected? Adobe · Adobe Commerce · 0 - 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug Adobe · Adobe Commerce B2B · 0 - 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug Adobe · Magento Open Source · 0 - 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug Is there a patch? Yes. Update to one of these or later:
Adobe Commerce Hotfix for CVE-2026-7565 Adobe Commerce B2B Hotfix for CVE-2026-7565 Magento Open Source Hotfix for CVE-2026-7565
From Adobe's CVE record · Adobe advisory
What PlainSec published about CVE-2026-75650 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-18.
CVE-2026-75650: listed in the CISA KEV catalog CVE-2026-75650 · CVSS 10.0 CRITICAL · EPSS 4% · KEV 2026-09-08 · patch available
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Is CVE-2026-75650 exploited? Listed in the CISA KEV catalog on 2026-09-08. Federal remediation due 2026-09-11. Past that date by 48 days. EPSS puts exploitation in the next 30 days at 4%. Public exploit code: none found in monitored sources. Which products and versions are affected? Adobe · Adobe Commerce · 0 - 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug Adobe · Adobe Commerce B2B · 0 - 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug Adobe · Magento Open Source · 0 - 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug Is there a patch? Yes. Update to one of these or later:
Adobe Commerce Hotfix for CVE-2026-7565 Adobe Commerce B2B Hotfix for CVE-2026-7565 Magento Open Source Hotfix for CVE-2026-7565
From Adobe's CVE record · Adobe advisory
What PlainSec published about CVE-2026-75650 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-18.