Unauthenticated RCE in Adobe Commerce and Magento (CVE-2026-75650)

A maximum-severity Adobe Commerce and Magento vulnerability allows remote, unauthenticated attackers to execute arbitrary code directly on vulnerable web servers. Tracked as CVE-2026-75650 with a peak CVSS v3.1 score of 10.0, the security flaw stems from improper neutralization of special elements inside the application’s template engine (CWE-1336). Because the issue can be exploited over the network without user interaction or prior authentication, unmanaged storefronts face severe risk of immediate compromise.

Vulnerability Mechanics and Exploitation Paths

In Magento and Adobe Commerce architectures, template engines process dynamic directives used throughout customer-facing storefronts, CMS blocks, transactional emails, and checkout workflows. CVE-2026-75650 arises when special elements within user-supplied inputs pass into the template renderer without sufficient sanitization.

The underlying metrics reflect an ideal target for automated exploitation:

• CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Access Vector: Network reachable (AV:N) with low attack complexity (AC:L).
• Privileges & Interaction: Zero privileges required (PR:N) and no user interaction needed (UI:N).
• Scope: Changed (S:C), indicating that successful exploitation breaks out of the immediate template processing boundary to compromise the broader underlying web application and server environment.

In practice, an attacker can issue a single HTTP request containing malicious template directives to guest-accessible endpoints—such as REST/GraphQL APIs, contact forms, or newsletter signups—that trigger background template evaluation. Once interpreted by the server, these directives allow arbitrary PHP execution. From there, threat actors typically establish persistence, pull database credentials from app/etc/env.php, and install persistent web shells or JavaScript payment skimmers directly into the storefront renderer.

Risk Context: CVSS 10.0 vs. Early EPSS Metrics

The vulnerability carries an initial Exploit Prediction Scoring System (EPSS) probability of 0.68% (placing it in the 50th percentile of all scored CVEs). While a 50th-percentile EPSS figure might superficially appear moderate, security teams must evaluate this metric in context: EPSS relies on historical and real-time telemetry that lags during the immediate post-disclosure window before public weaponized exploit chains circulate.

E-commerce infrastructure remains one of the highest-value targets for cybercrime ecosystems. Historically, template injection vulnerabilities in Adobe Commerce and Magento are aggressively monetized by Magecart syndicates and initial access brokers. Given the combination of low attack complexity, scope expansion, and unauthenticated access, the actual threat profile is extreme. As soon as reverse-engineered proof-of-concept exploits circulate, internet-wide scanning and automated exploitation will follow rapidly.

Affected Versions and Required Actions

This vulnerability impacts a wide range of Adobe Commerce and Magento Open Source releases, specifically:

• Adobe Commerce and Magento Open Source versions prior to 2.4.4
• Supported release trains including 2.4.4, 2.4.5, 2.4.6, 2.4.7, and 2.4.8

Remediation Guidelines

1. Deploy Official Vendor Updates: Apply the permanent patches issued under Adobe Security Advisory APSB26-146 immediately across all production and staging environments.
2. Adhere to Remediation Timelines: Organizations operating under federal risk management frameworks or CISA BOD 26-04 guidance must complete remediation by the mandatory compliance date of September 11, 2026.
3. Apply Temporary WAF Mitigations: If emergency patching cannot be executed immediately due to third-party module dependencies, deploy Web Application Firewall (WAF) rules to inspect incoming POST requests for unexpected template directives or nested layout parameters.
4. Conduct Forensics Triage: Inspect web application logs for unusual GraphQL/REST API traffic targeting dynamic layout or preview parameters. Verify file integrity across core Magento files, pub/static/, and vendor directories to detect pre-existing backdoors or unauthorized code modifications.