Adobe Commerce: code execution via template engine (CVE-2026-75650)

Code execution in Adobe Commerce without user interaction, CVSS 10.0, listed in CISA KEV. Apply patch APSB26-146.

On 7 September 2026 the record for CVE-2026-75650 was published, a template injection vulnerability in Adobe Commerce. According to the record, it can lead to code execution with the privileges of the current user, without user interaction. The CVSS v3.1 score is 10.0, with changed scope.

The vulnerability is in CISA's KEV catalogue: it is therefore among those with signs of active exploitation. Adobe published the patch in bulletin APSB26-146.

Apply patch APSB26-146 to all Adobe Commerce and Magento installations. Also check third-party extensions that use templates, as they may inherit the same problem.

At a glance

What: Template injection in Adobe Commerce that can lead to code execution with the privileges of the current user, without user interaction.
Severity: CVSS v3.1 10.0 (critical), with changed scope, according to the Adobe record on NVD.
Cause: Insufficient neutralisation of special elements in a template engine (CWE-1336).
Status: Listed in the CISA KEV catalogue, so reported as actively exploited.
Action: Apply Adobe patch APSB26-146. Also check third-party extensions that use templates.

Sources: NVD, CVE-2026-75650 · Adobe, APSB26-146 · CISA, catalogo KEV

← All articles