- Critical 10.0
- Known exploited (CISA KEV)
CVE-2026-75650
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Scores
The facts
- Published
- 7 September 2026
- Last changed
- 9 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 10.0 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- Affects
- adobe commerce
- adobe commerce b2b
- adobe magento
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 September 2026.
- EPSS
- 3.9% chance of exploitation activity in the next 30 days (percentile 90).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.