by Kastro
Paper/Archive/CVE-2026-75650

CVE-2026-75650

Adobe Adobe Commerce — Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

KEV · due 11 SepEPSS 4%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
98
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 90.4.904 × 2018.1Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-augHotfix for CVE-2026-7565CNA
Adobe Commerce B2B≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-augHotfix for CVE-2026-7565CNA
Magento Open Source≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-augHotfix for CVE-2026-7565CNA

Scores by source

adobe (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb26-146.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650kevcisa.gov/known-exploited-vulnerabilities-catalog