Adobe Commerce / Magento CVE-2026-75650: unauthenticated RCE rated 10/10, already exploited

> In short: CVE-2026-75650 affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source (versions ≤ 2.4.9-2026-aug for Commerce and Magento Open Source, ≤ 1.5.3-2026-aug for B2B). It's a template-engine injection flaw (CWE-1336), remotely exploitable with no authentication or user interaction required, allowing arbitrary code execution in the context of the current user — with a scope change that opens the door to full takeover of the store and its infrastructure. CVSS score: 10.0, the maximum possible. The flaw is confirmed to be actively exploited in the wild. Adobe released an emergency hotfix ("VULN-39341") on September 7, 2026, in bulletin APSB26-146.

How the exploitation works

The vulnerability allows malicious code to be injected into Magento's template system by exploiting the parser at the style-properties level, bypassing some existing security filters. The documented attack vector runs through failed-payment or error-reporting workflows: an injected payload is stored and later executed when Magento renders certain templated emails — typically failed-payment reminders. Notably, exploitation requires no human to open the email. The code executes server-side at template render time, which explains why stores already patched against previous issues were still hit until the emergency hotfix shipped.

Once code execution was achieved, analysts documented the installation of persistent backdoors and malicious cron jobs, enabling durable access even after a superficial initial cleanup.

Why the 10/10 rating is justified

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) checks every box of the worst-case scenario: network-exploitable, low attack complexity, no privileges required, no user interaction, changed scope, and maximum impact on confidentiality, integrity, and availability. In practice, an anonymous attacker can, with a single well-formed request, achieve code execution on an e-commerce server potentially holding tens of thousands of orders, customer records, and payment details.

What Adobe Commerce and Magento stores must do

The lesson for e-commerce platforms

A 10.0 CVSS score on a widely deployed e-commerce platform is a maximum-alert signal: the combination of "no authentication required" and "arbitrary code execution" turns any unpatched Magento store into a target that can be automated at scale. For companies operating or integrating Adobe Commerce/Magento stores, patch speed after a 9+ rated CVE is no longer a best practice — it's operational survival, especially since active exploitation preceded the public availability of the full fix.