CVE-2026-75650: Adobe Commerce and Magento Template Engine Flaw Added to CISA KEV

TL;DR

CISA added CVE-2026-75650, an improper neutralization of special elements used in a template engine vulnerability in Adobe Commerce and Magento Open Source, to the Known Exploited Vulnerabilities catalog on 2026-09-08. The flaw can lead to arbitrary code execution and carries a CVSS score of 10 (CRITICAL) per Adobe PSIRT. Federal and regulated patch owners must apply vendor mitigations by 2026-09-11 — treat this as a same-week emergency patch for any internet-facing storefront.

What is this vulnerability?

• CVE ID: CVE-2026-75650
• Vendor / product: Adobe / Commerce and Magento Open Source
• Vulnerability name: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• Weakness class: CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine)
• Impact: Arbitrary code execution in the context of the current user; scope is changed and no user interaction is required.
• CVSS: 10 (CRITICAL), source psirt@adobe.com, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• CISA KEV status: Yes — added 2026-09-08
• CISA due date: 2026-09-11
• Known ransomware use: Unknown

Per the official summary, Adobe Commerce is affected by an improper neutralization of special elements used in a template engine vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the scope is changed — meaning the vulnerable component can affect resources beyond its security scope, which raises the blast radius for multi-tenant or shared hosting environments.

CISA's required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 Prioritizing Security Updates Based on Risk and CISA's Forensics Triage Requirements. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Where mitigations are unavailable for cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product.

KEV vs CVSS vs EPSS

Signal	What it measures	How to use it for this CVE
CISA KEV	Confirmed in-the-wild exploitation	Authoritative trigger. CVE-2026-75650 is listed (added 2026-09-08, due 2026-09-11). This drives your remediation SLA.
CVSS	Theoretical severity of the flaw	10 (CRITICAL) from Adobe PSIRT — network-exploitable, no privileges, no user interaction, scope changed. Justifies emergency change-board treatment.
EPSS	Probability of exploitation in the next 30 days	0.02148 (81.229 percentile). Modest probability but non-trivial percentile — do not use EPSS to deprioritize; KEV already confirms exploitation.

Defender takeaway: KEV overrides EPSS for prioritization. A low EPSS score does not downgrade a KEV listing — it only tells you the broad internet hasn't fully weaponized it yet. Your exposure window is now.

Step-by-step remediation

1. Inventory. Enumerate every Adobe Commerce (cloud and on-prem) and Magento Open Source instance, including staging, dev, and forgotten storefronts. Tag each asset with internet exposure status, version, and business owner.
2. Patch or mitigate. Apply the vendor fix per Adobe security bulletin apsb26-146. If a patch is not yet deployable, apply Adobe's documented mitigations and follow BOD 26-04 guidance for cloud services — or discontinue use of the affected product until mitigations are available.
3. Verify. Confirm the patched version is running on every node, clear caches and compiled templates, and re-scan to validate the fix. Check for signs of prior exploitation in web, application, and template-render logs.
4. Triage forensics. Execute CISA's Forensics Triage Requirements under BOD 26-04 on any asset that was internet-facing before patching.
5. Close the ticket. Document patch version, verification evidence, exposure assessment, and triage outcome. Confirm the 2026-09-11 due date is met and retain evidence for audit.

FAQ

Is CVE-2026-75650 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-08.

What is the CISA due date? 2026-09-11. That is the deadline for federal civilian agencies under BOD 26-04; regulated and risk-averse private organizations should treat it as their own SLA.

Is this exploitable over the internet? The CVSS vector (AV:N, AC:L, PR:N, UI:N) indicates network-exploitable with no privileges or user interaction required. Any internet-facing Adobe Commerce or Magento storefront should be considered exposed until patched.

Is there a ransomware tie? CISA lists known ransomware use as Unknown for this CVE. Absence of a confirmed ransomware association does not reduce urgency — arbitrary code execution on a commerce platform is a direct path to payment data and customer PII.

What is the weakness class? CWE-1336, improper neutralization of special elements used in a template engine. This class of bug lets attacker-controlled input reach template evaluation, which is why the outcome is code execution rather than simple data disclosure.

Do I need to patch staging and dev? Yes. Staging environments frequently share credentials, database backends, or network paths with production. Treat every instance as in scope.

Related resources

• Adobe Security Bulletin apsb26-146
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD entry for CVE-2026-75650