This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Adobe fixes an actively exploited vulnerability

Adobe has released an out-of-band hotfix VULN-39341 [1] for a critical, actively exploited vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source [2]. Deploying the hotfix alone is not sufficient; Adobe requires subsequent rotation of the encryption key and all access credentials [1]. Known IoCs can be found at [3].

Adobe Commerce & Magento Open Source - arbitrary code execution (CVE-2026-75650)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute arbitrary code in the context of the current user due to improper neutralization of special elements processed by a template engine [2].

The vulnerability is present in products:

  • Adobe Commerce; <=2.4.9-2026-aug; <=2.4.8-2026-aug; <=2.4.7-2026-aug; <=2.4.6-2026-aug; <=2.4.5-2026-aug; <=2.4.4-2026-aug
  • Adobe Commerce B2B; <=1.5.3-2026-aug; <=1.5.2-2026-aug; <=1.4.2-2026-aug; <=1.3.4-2026-aug; <=1.3.3-2026-aug
  • Magento Open Source; <=2.4.9-2026-aug; <=2.4.8-2026-aug; <=2.4.7-2026-aug; <=2.4.6-2026-aug

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-75650 at cve.org, NVD
  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine at cwe.mitre.org

The vulnerability was publicly disclosed 7. 9. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 8. 9. 2026.

CESNET, z.s.p.o. Logo