CVE Alert: CVE-2026-75650 – Adobe

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

**Risk verdict:** This is an urgent, priority-one risk: active exploitation is recorded and the issue is remotely reachable without authentication or user interaction.

**Why this matters:** Successful compromise can give an attacker control over application confidentiality, integrity and availability, including customer, order and administrative data. The changed scope increases concern that access may be leveraged into connected services, payment workflows, hosting infrastructure or internal systems. Exploitation is assessed as automatable with total technical impact; no exploit-maturity or PoC detail is provided, but active exploitation outweighs that uncertainty.

**Most likely attack path:** An attacker sends crafted network requests to an exposed storefront or associated application endpoint; attack complexity is low, with no privileges or victim action required. Code execution in the application context could enable web-shell persistence, data theft, fraudulent transactions, supply-chain abuse or pivoting towards adjacent services, depending on network segmentation and service-account permissions.

**Who is most exposed:** Internet-facing online retailers, managed hosting tenants and organisations running B2B storefronts or public administrative integrations are the primary targets. High-volume sites with extensive extensions, payment connectors or privileged service accounts present greater downstream impact.

Review web, application and WAF logs for anomalous template-related input.

Hunt for new files, modified templates, scheduled tasks and unexpected outbound connections.

Check administrative, database and cloud credentials for suspicious use.

Compare deployed files and extensions against known-good baselines.

Mitigation and prioritisation:

Treat as priority 1; apply the vendor hotfix immediately, prioritising internet-facing systems.

If delayed, restrict administrative and integration endpoints, enforce WAF rules and isolate application hosts.

Rotate application-accessible secrets after remediation and investigate persistence.

Use expedited change control with staging validation and rollback planning.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.