CVE-2026-75650 / Adobe APSB26-146: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Recommended actionPatch now

CISA confirms exploitation in the wild and lists 2026-09-11 as the remediation due date.

Patch available

What, why and how

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

What

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

Why

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.

What

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

Why

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

Confirmed in the wild

CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-09-08.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: a network path → Improper Neutralization of Special Elements Used in a Template Engine → execute code or commands in the affected security context
Attack surface: Network
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Changed: exploitation can affect a different security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-1336 ↗
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SChangedScope: The attack can affect a component governed by a different security authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: After compromise, an attacker may use built-in shells, scripting engines, scheduled tasks and native network utilities for discovery, persistence or movement. This is a plausible LoTL path, not evidence that it has occurred for every attack.

NetworkUnauthenticatedRemote code executionCWE-1336CISA KEV

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2026-72530Known-exploited evidence recorded

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Official EUVD record ↗

BSI · German · WID-SEC-2026-3223Adobe Magento Open Source: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Adobe Magento ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

Official advisory ↗

BSI · German · WID-SEC-2026-3944Adobe Magento Open Source: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Adobe Magento Open Source ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen sowie Daten offenzulegen oder zu manipulieren.

Official advisory ↗

BSI · German · WID-SEC-2026-3246Adobe Magento: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Berechtigungen zu erweitern oder Sicherheitsmaßnahmen zu umgehen.

Official advisory ↗

Canadian Centre for Cyber Security · English · AV26-888Adobe security advisory (AV26-888) – Update 1

As of September 8, 2026, Adobe is affected by a vulnerability in the following products: Adobe indicates that CVE-2026-75650 is exploited in the wild.

Official advisory ↗

Cyber Security Agency of Singapore · English · CSA-SB-20260909Security Bulletin 9 Sep 2026

The Cyber Security Agency of Singapore included this CVE in its official Security Bulletin 9 Sep 2026, published on 9 September 2026. Open the linked bulletin for the product, severity and reference information published in that issue.

Official advisory ↗

CERT-FR · French · CERTFR-2026-AVI-1301Avis du CERT-FR

2026-106620 Référence CVE CVE-2026-106621 https://www.cve.org/CVERecord?id=CVE-2026-106621 Référence CVE CVE-2026-106622 https://www.cve.org/CVERecord?id=CVE-2026-106622 Référence CVE CVE-2026-106623 https://www.cve.org/CVERecord?id=CVE-2026-106623 Référence CVE CVE-2026-106624 https://www.cve.org/CVERecord?id=CVE-2026-106624 Référence CVE CVE-2026-34633 https://www.cve.org/CVERecord?id=CVE-2026-34633 Référence CVE CVE-2026-34634 https://www.cve.org/CVERecord?id=CVE-2026-34634 Référence CVE CVE-2026-48378 https://www.cve.org/CVERecord?id=CVE-2026-48378 Référence CVE CVE-2026-71385 https://www.cve.org/CVERecord?id=CVE-2026-71385 Référence CVE CVE-2026-75650 https://www.cve.org/CVERecord?id=CVE-2026-75650 Référence CVE CVE-2026-75748 https://www.cve.org/CVERecord?id=CVE-2026-75748 Référence CVE CVE-2026-75994 https://www.cve.org/CVERecord?id=CVE-2026-75994 Référence CVE CVE-2026-75995 https://www.cve.org/CVERecord?id=CVE-2026-75995 Référence CVE CVE-2026-75996 https://www.cve.org/CVERecord?id=CVE-2026-75996 Référence CVE CVE-2026-76001 https://www.cve.org/CVERecord?id=CVE-2026-76001 Référence CVE CVE-2026-90530 https://www.cve.org/CVERecord?id=CVE-2026-90530 Référence CVE CVE-2026-91013 https://www.cve.org/CVERecord?id=CVE-2026-91013 Référence CVE CVE-2026-92464 https://www.cve.org/CVERecord?id=

Official advisory ↗

CERT-FR · French · CERTFR-2026-AVI-1130Vulnérabilité dans les produits Adobe

Une vulnérabilité a été découverte dans les produits Adobe. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. Adobe indique que la vulnérabilité CVE-2026-75650 est activement exploitée.

Official advisory ↗

NBSZ-NKI · Hungarian · cve-2026-75650CVE-2026-75650

A termék egy sablonmotort használ külső forrásból befolyásolható bemenetek beillesztésére vagy feldolgozására, azonban nem semlegesíti megfelelően – vagy egyáltalán nem semlegesíti – azokat a speciális elemeket vagy szintaktikai elemeket, amelyeket a sablonmotor sablonkifejezésekként vagy más kódutasításokként értelmezhet és végrehajthat.

Official advisory ↗

CSIRT Italia · Italian · adobe-rilevato-sfruttamento-in-rete-della-cve-2026-75650Adobe: rilevato sfruttamento in rete della CVE-2026-75650

In dettaglio, la vulnerabilità - identificata tramite la CVE-2026-75650 , di tipo "Improper Neutralization of Special Elements Used in a Template Engine" e con score CVSS v3.1 pari a 10.0 - interessa la gestione della validazione degli elementi speciali utilizzati dal template engine . Un attore malevolo, attraverso input applicativi opportunamente predisposti, può indurre il sistema a interpretare e valutare codice arbitrario all'interno del contesto di rendering dei template. Il contenuto iniettato viene successivamente elaborato dal runtime applicativo, consentendo l'esecuzione di istruzioni arbitrarie con i privilegi del processo web o dell'utente applicativo corrente.

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-6947Adobe 제품 보안 업데이트 권고

Adobe Commerce, Adobe Commerce B2B, Magento Open Source에서 발생하는 Improper Neutralization of Special Elements Used in a Template Engine 취약점(CVE-2026-75650) [1][2]

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-6945美 CISA 발표 주요 Exploit 정보공유(Update. 2026-09-08)

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Official advisory ↗

NCSC-NL · Dutch · NCSC-2026-0436Kwetsbaarheden verholpen in Adobe Commerce

Adobe Commerce and Magento Open Source contain a template engine vulnerability that allows arbitrary code execution in the current user's context due to improper neutralization of special elements.

Official advisory ↗

NCSC-NL · Dutch · NCSC-2026-0344Kwetsbaarheid verholpen in Adobe Commerce en Magento

Adobe Commerce contains a vulnerability in its template engine due to improper neutralization of special elements, enabling attackers to execute arbitrary code without user interaction and with an altered scope.

Official advisory ↗

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Patch available
Affected: Adobe Commerce: 0 ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
Magento Open Source: 0 ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
Adobe Commerce B2B: 0 ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
Fixed: Adobe Commerce: Hotfix for CVE-2026-7565
Adobe Commerce B2B: Hotfix for CVE-2026-7565
Magento Open Source: Hotfix for CVE-2026-7565
Action: Review the linked authoritative reference and apply the recorded fixed release appropriate to the affected product branch.
Workaround: No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.

Official vendor articles5 stored documents

Linked articles are downloaded and versioned as source evidence. A CVE mention or approved update relationship does not, by itself, verify a fix for every product branch.

Security update available for Adobe Commerce | APSB26-153 →Original publisher ↗Searchable text snapshot · Captured 29 Oct 2026#202020 Adobe Security Bulletin Last updated on Oct 13, 2026 Security update available for Adobe Commerce | APSB26-153 Bulletin ID Date published Priority APSB26-153 October 13, 2026 2 style grid width 12 Summary Adobe has released a priority 2 security update for Adobe Commerce. This update addresses vulnerabiliti
Security update available for Adobe Commerce | APSB26-138 →Original publisher ↗Searchable text snapshot · Captured 29 Oct 2026#202020 Adobe Security Bulletin Last updated on Sep 8, 2026 Security update available for Adobe Commerce | APSB26-138 Bulletin ID Date published Priority APSB26-138 September 8, 2026 2 style grid width 12 Summary Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves c
Security update available for Adobe Commerce | APSB26-138 →Original publisher ↗Searchable text snapshot · Captured 22 Oct 2026#202020 Adobe Security Bulletin Last updated on Sep 8, 2026 Security update available for Adobe Commerce | APSB26-138 Bulletin ID Date published Priority APSB26-138 September 8, 2026 2 style grid width 12 Summary Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves c
Security update available for Adobe Commerce | APSB26-146 →Original publisher ↗Searchable text snapshot · Captured 22 Oct 2026#202020 Adobe Security Bulletin Last updated on Sep 7, 2026 Security update available for Adobe Commerce | APSB26-146 Bulletin ID Date published Priority APSB26-146 September 7, 2026 1 style grid width 12 Summary Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a
Security update available for Adobe Commerce | APSB26-146 →Original publisher ↗Searchable text snapshot · Captured 22 Oct 2026#202020 Adobe Security Bulletin Last updated on Sep 7, 2026 Security update available for Adobe Commerce | APSB26-146 Bulletin ID Date published Priority APSB26-146 September 7, 2026 1 style grid width 12 Summary Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a

Evidence and provenance

Published 7 Sept 2026 · Last source change 9 Sept 2026, 04:25 UTC · CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine

CVE recordCVE.org · 5.2

CVSS sourceCNA

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-09-09

European sourceENISA EUVD · EUVD-2026-72530

Product sourceCISA KEV

Remediation sourceCVE/CNA references

CWE sourceCNA

NVD statusNVD enriched

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗

14 Oct 2026, 15:47 UTC
BlackTree coverageBlackTree article coverage changed from 1 BlackTree article to 2 BlackTree articles.
Before
1 BlackTree article
After
2 BlackTree articles
BlackTree editorial ↗
29 Sep 2026, 11:09 UTC
BlackTree coverageBlackTree article coverage changed from no BlackTree article to 1 BlackTree article.
Before
no BlackTree article
After
1 BlackTree article
BlackTree editorial ↗
9 Sep 2026, 15:04 UTC
ENISA known-exploited stateENISA EUVD now records this CVE in its known-exploited dataset.
Before
not listed in ENISA EUVD known-exploited dataset
After
listed in ENISA EUVD known-exploited dataset (EUVD-2026-72530)
ENISA EUVD ↗
9 Sep 2026, 04:25 UTC
Affected versionsThe structured affected or fixed version information changed.
Before
≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug; ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug; ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug · Fixed: Hotfix for CVE-2026-7565
After
Adobe Commerce: ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug; Adobe Commerce B2B: ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug; Magento Open Source: ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug · Fixed: Adobe Commerce: Hotfix for CVE-2026-7565; Adobe Commerce B2B: Hotfix for CVE-2026-7565; Magento Open Source: Hotfix for CVE-2026-7565
CNA ↗
8 Sep 2026, 18:57 UTC
ENISA EUVD mappingEUVD-2026-72530 was added to the official ENISA EUVD mapping for this CVE.
Before
not recorded
After
{"euvdId":"EUVD-2026-72530"}
ENISA EUVD ↗
8 Sep 2026, 09:45 UTC
Vendor guidanceAuthoritative vendor guidance changed: added patch: helpx.adobe.com/apsb26-146.html.
Before
remediation: helpx.adobe.com/apsb26-146.html
After
patch: helpx.adobe.com/apsb26-146.html · remediation: helpx.adobe.com/apsb26-146.html
psirt@adobe.com ↗
8 Sep 2026, 09:45 UTC
CISA KEV stateCISA KEV now confirms exploitation in the wild.
Before
not listed in CISA KEV
After
listed in CISA KEV since 2026-09-08
CISA KEV ↗
7 Sep 2026, 20:17 UTC
Catalogue recordCVE added to the BlackTree catalogue.
CNA ↗

2026-09-07CVE published

2026-09-08Added to CISA KEV

2026-09-09Fixed release or patch reference recorded

ENISA EUVD · EUVD-2026-72530↗CISA KEV record↗CVE authority or vendor reference · Adobe APSB26-146↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Published severity in operational context

Evidence used

Compensating controls

Verification

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

ENISA European Vulnerability Database

EUVD-2026-72530

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

What changed after publication