Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
TL;DR 📌
- Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
- Highest CVSS: 10.0 (Critical).
- Listed in CISA KEV (2026-09-08) — this is being exploited in the wild.
- Fixed in
1.3.3,2.4.4,2.4.6— upgrade to this release or later. - CVEs: CVE-2026-75650.
What it is
CVE-2026-75650 is a server-side template injection flaw in Adobe Commerce and Magento Open Source. The vulnerability sits in the platform’s template engine, where special characters used in template syntax are not properly neutralised before being processed. An attacker who can get crafted input into a template context can have it evaluated, resulting in arbitrary code execution in the context of the user running the application.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates this is reachable over the network, requires no privileges and no user interaction, and low attack complexity. The scope change (S:C) means the impact extends beyond the vulnerable component itself, and confidentiality, integrity and availability are all rated high — full compromise of the affected instance is in scope.
This is in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-09-08. This means it is known to be exploited.
What to do
- Patch to the fixed versions listed by Adobe/NVD: 1.3.3, 2.4.4, or 2.4.6, depending on which line you run. Identify your current Commerce/Magento version first, since the correct target release differs by branch.
- Given the KEV listing, treat this as urgent — patch outside normal cycles rather than waiting for a scheduled maintenance window.
- After patching, review application and web server logs for signs of template injection attempts predating the fix, particularly unusual input to fields that feed template rendering.
- Restrict network exposure to the Commerce/Magento admin and storefront where possible while patching is scheduled, as no authentication or user interaction is required to exploit this.
- Consult Adobe’s own advisory for the exact upgrade path and any interim mitigation guidance, since version-specific patching instructions are not included here.
For leadership 🧭
Executive summary. Any internet-facing Adobe Commerce or Magento Open Source storefront running an unpatched version can be fully compromised by an attacker with no login and no user interaction required, and CISA already lists this as being exploited. This needs emergency patching now, not at the next scheduled maintenance window.
Why it matters:
- The flaw is in the template engine itself, so any input path that reaches template rendering can be turned into arbitrary code execution as the application user, with confidentiality, integrity and availability all rated high.
- No authentication or user interaction is needed and the attack complexity is low, so exposed storefronts and admin panels are directly reachable over the network.
- CISA added this to its Known Exploited Vulnerabilities catalogue on 2026-09-08, meaning attacks against unpatched Commerce/Magento instances are already occurring.
- The scope change in the CVSS vector means a successful exploit can affect resources beyond the vulnerable component, extending impact past the storefront application itself.
Now / Next / Later:
- Now: Identify which Commerce/Magento branch each store is running and confirm whether it is already on 1.3.3, 2.4.4 or 2.4.6.
- Next: Patch every affected instance to the appropriate fixed version outside normal change windows, and in the meantime restrict network access to admin and storefront endpoints wherever feasible.
- Later: Review application and web server logs for template-injection attempts predating the patch, and build a process for fast-tracking KEV-listed fixes for e-commerce platforms rather than waiting on standard release cycles.