CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Actively exploited: added to CISA’s KEV catalog on September 8, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: September 11, 2026.

Description from CISA’s KEV catalog.

Our analyses

Magento stores: a 10/10 vulnerability, and the fix has to be applied by hand

Adobe patched a flaw on October 13 that allows unauthenticated code execution. No attacks are known, but Sansec reproduced four variants within 24 hours. Here are the affected versions and the checks to run.

Oct 17, 20262 min read

What to do

Check whether your estate includes Adobe Commerce and Magento, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (helpx.adobe.com)
NVD entry (NIST)
CISA KEV catalog

Other Adobe vulnerabilities

All exploited Adobe vulnerabilities

CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Our analyses

Magento stores: a 10/10 vulnerability, and the fix has to be applied by hand

What to do

References

Other Adobe vulnerabilities

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe ColdFusion Path Traversal Vulnerability

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Adobe Acrobat Use-After-Free Vulnerability

Adobe Commerce and Magento Improper Input Validation Vulnerability

Our analyses

Magento stores: a 10/10 vulnerability, and the fix has to be applied by hand

What to do

References

Other Adobe vulnerabilities

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe ColdFusion Path Traversal Vulnerability

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Adobe Acrobat Use-After-Free Vulnerability

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe Commerce and Magento Improper Input Validation Vulnerability