CVE-2026-75650

Think of this as a “code injection” weakness inside how the store software builds pages and templates. An attacker can send crafted input that the software mishandles, allowing the attacker to run code on your system. Because it’s already being exploited in the real world, it can quickly turn a public website into a full server compromise.

This matters if you run Adobe Commerce or Magento (including the “commerce”, “commerce b2b”, “adobe commerce”, “Adobe Commerce B2B”, and “magento open source” variants). It’s relevant to small businesses because it can be triggered remotely without requiring your staff to click anything, and exploitation has been confirmed by CISA.
It’s most urgent when your Adobe Commerce/Magento application is reachable from the internet or exposed through any internet-facing service or route where an attacker can supply the crafted data.

This is RED because CISA has confirmed real-world exploitation and set a due date of 2026-09-11. Attackers are actively using this weakness to get code execution, so delaying patching meaningfully increases the chance you’ll be targeted. Move immediately to the fixed versions/hotfixes for your exact product and confirm exposure is reduced after the update.

1. Identify your exact deployment and version

   • Determine which product variant you’re running (commerce, commerce b2b, magento, adobe commerce, Adobe Commerce B2B, magento open source).
   • Record the currently installed version so you can compare it to the fixed versions below.

2. Confirm whether the vulnerable product is exposed

   • Review what internet-facing URLs exist for your store and admin interfaces.
   • Prioritize assets that are reachable from the internet, because CISA guidance emphasizes evaluating each asset’s internet exposure.

3. Apply the vendor fixes (per your branch)

   • commerce: upgrade to 2.4.4
   • commerce b2b: upgrade to 1.3.3
   • magento: upgrade to 2.4.6
   • adobe commerce / Adobe Commerce B2B / magento open source: install the Adobe-provided Hotfix for CVE-2026-7565
   • Use the vendor remediation guidance linked in the Adobe bulletin (APS B26-146).

4. Validate after upgrade

   • Re-test the application’s normal store flows to ensure the hotfix/upgrade didn’t break functionality.
   • Confirm the updated system is running the intended version/hotfix.

5. If patching is delayed: reduce exposure immediately

   • Restrict public access to only what is necessary (for example, limit internet exposure of store/admin endpoints to the minimum required).
   • Follow vendor instructions for interim mitigations where available.
   • If mitigations aren’t available, CISA guidance indicates you should discontinue use of the product until mitigations can be applied.

6. Forensics/triage readiness (because CISA KEV is involved)

   • Follow CISA “Forensics Triage Requirements” as part of your post-change validation or incident-readiness process.
   • Check logs for suspicious activity around template/page rendering inputs, unexpected requests, and any signs of unexpected code execution.

7. Due date

   • CISA remediation due date: 2026-09-11.

CVE-2026-75650 is a CWE-1336 issue in Adobe Commerce/Magento related to improper neutralization of special elements used in a template engine. Impact is high: the weakness can enable arbitrary code execution in the context of the current user, without requiring user interaction.

This CVE is listed in CISA KEV (confirmed real-world exploitation), added on 2026-09-08, which elevates response urgency beyond “theoretical” or “only proof-of-concept.” No public exploit code is listed in the findings, but KEV indicates attackers have successfully exploited the vulnerability in the wild.

Fix availability is explicit via product-specific fixed versions and Adobe-provided hotfixes for CVE-2026-7565, so remediation should be straightforward and should focus on getting every affected environment on the stated fixed release.