Adobe Commerce Template Engine Improper Neutralization Exploit (CVE-2026-75650)
CVE-2026-75650 Published on September 7, 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Vendor Advisory NVD

Known Exploited Vulnerability

This Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vul vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

The following remediation steps are recommended / required by September 11, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab

Vulnerability Analysis

CVE-2026-75650 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

CWE-1336

Products Associated with CVE-2026-75650

Want to know whenever a new CVE is published for Adobe products? stack.watch will email you.

Adobe Commerce
 
Adobe Commerce B2b
 
Adobe Magento Open Source
 
Adobe Commerce
 

Affected Versions

Adobe Commerce: Adobe Commerce B2B: Adobe Magento Open Source: