CVE-2026-75650 · High · CISA KEV

Adobe Commerce/Magento RCE: Template Engine Vulnerability Actively Exploited

Threat Engine Auto-Feed · data current as of 2026-09-09

CVE-2026-75650, affecting Adobe Commerce and Magento Open Source, is an improper neutralization of special elements vulnerability that allows for arbitrary code execution. It is listed in CISA KEV, indicating active exploitation in the wild, with an EPSS score in the 81st percentile.

  • CVSS:
  • EPSS percentile: 0.8102
  • Exploitation pressure: 74/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 81th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves a flaw in how the software handles special characters or elements within its template engine. If an attacker can inject malicious code into these templates, the system will process it without proper sanitization, leading to the execution of arbitrary code.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Adobe Commerce or Magento Open Source for e-commerce platforms
  • Financial services organizations (due to specific threat actor targeting)
  • Technology companies (due to specific threat actor targeting)

Misconfigurations that escalate it

  • Lack of robust input validation on user-controlled fields that feed into template engines
  • Outdated Adobe Commerce or Magento Open Source installations

High-impact scenarios

  • Remote Code Execution (RCE) on the e-commerce platform, leading to full system compromise.
  • Data theft, including customer information, payment details, and proprietary business data.
  • Website defacement or complete disruption of e-commerce operations.
  • Establishment of persistent access for further network penetration.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unusual process execution or file modifications on Adobe Commerce/Magento servers.
  • Look for unexpected network connections originating from the e-commerce platform.
  • Review web server logs for suspicious requests targeting template engine functionalities or unusual parameters.

Contain

  • Isolate affected Adobe Commerce/Magento instances from the broader network.
  • Block suspicious IP addresses identified in logs at the network perimeter.

Patch

  • Apply the latest security updates and patches from Adobe for Commerce and Magento Open Source immediately.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and potential for arbitrary code execution on critical e-commerce platforms.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.