CVE Details

CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Published: 2026-09-08 CVSS: 10 CRITICAL Product: Adobe Commerce and Magento Due Date: 2026-09-11

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 10
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-75650
cveMetadata > assignerOrgId 078d4453-3bcd-4900-85e6-15281da43538
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName adobe
cveMetadata > dateReserved 2026-08-18T01:29:54.614Z
cveMetadata > datePublished 2026-09-07T20:17:16.761Z
cveMetadata > dateUpdated 2026-09-08T18:48:21.634Z
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > product Adobe Commerce
containers > cna > affected > 0 > vendor Adobe
containers > cna > affected > 0 > versions > 0 > lessThanOrEqual 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 1 > status unaffected
containers > cna > affected > 0 > versions > 1 > version Hotfix for CVE-2026-7565
containers > cna > affected > 0 > versions > 1 > versionType custom
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > affected > 1 > product Adobe Commerce B2B
containers > cna > affected > 1 > vendor Adobe
containers > cna > affected > 1 > versions > 0 > lessThanOrEqual 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 0
containers > cna > affected > 1 > versions > 0 > versionType custom
containers > cna > affected > 1 > versions > 1 > status unaffected
containers > cna > affected > 1 > versions > 1 > version Hotfix for CVE-2026-7565
containers > cna > affected > 1 > versions > 1 > versionType custom
containers > cna > affected > 2 > defaultStatus unaffected
containers > cna > affected > 2 > product Magento Open Source
containers > cna > affected > 2 > vendor Adobe
containers > cna > affected > 2 > versions > 0 > lessThanOrEqual 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 2 > versions > 0 > version 0
containers > cna > affected > 2 > versions > 0 > versionType custom
containers > cna > affected > 2 > versions > 1 > status unaffected
containers > cna > affected > 2 > versions > 1 > version Hotfix for CVE-2026-7565
containers > cna > affected > 2 > versions > 1 > versionType custom
containers > cna > datePublic 2026-09-07T17:00:00.000Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > availabilityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > baseScore 10
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > confidentialityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > environmentalScore 10
containers > cna > metrics > 0 > cvssV3_1 > environmentalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > exploitCodeMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > modifiedAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedPrivilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > modifiedScope CHANGED
containers > cna > metrics > 0 > cvssV3_1 > modifiedUserInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > remediationLevel NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > reportConfidence NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > scope CHANGED
containers > cna > metrics > 0 > cvssV3_1 > temporalScore 10
containers > cna > metrics > 0 > cvssV3_1 > temporalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-1336
containers > cna > problemTypes > 0 > descriptions > 0 > description Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > providerMetadata > orgId 078d4453-3bcd-4900-85e6-15281da43538
containers > cna > providerMetadata > shortName adobe
containers > cna > providerMetadata > dateUpdated 2026-09-07T20:17:16.761Z
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 0 > url https://helpx.adobe.com/security/products/magento/apsb26-146.html
containers > cna > source > discovery EXTERNAL
containers > cna > title Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
containers > cna > x_generator > engine cvelib 1.8.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-75650
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-08T18:44:04.878935Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-08T18:48:21.634Z