Adobe has released a security update, APSB26-146, for Adobe Commerce and Magento Open Source to address a critical security vulnerability affecting supported platform versions. The vulnerability could potentially allow an unauthenticated attacker to execute arbitrary code on affected installations.

Adobe has assigned this update a Priority 1 rating and strongly recommends that merchants and store administrators apply the available hotfix as soon as possible. Adobe has also confirmed that the vulnerability addressed by this update is being actively exploited in the wild, making timely patching essential to protect affected environments.

Affected Versions

The affected versions include various iterations of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Users running the following versions or earlier should take action:

  • Adobe Commerce: 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier, 2.4.5-2026-aug and earlier, and 2.4.4-2026-aug and earlier.
  • Adobe Commerce B2B: 1.5.3-2026-aug and earlier, 1.5.2-2026-aug and earlier, 1.4.2-2026-aug and earlier, 1.3.4-2026-aug and earlier, and 1.3.3-2026-aug and earlier.
  • Magento Open Source: 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, and 2.4.6-2026-aug and earlier.

The vulnerability affects installations across all supported platforms, making it important for merchants and development teams to review their current version and security patch level.

Solution

Adobe has released updated versions for both Adobe Commerce and Magento Open Source to address these vulnerabilities. Merchants using affected versions should take the following steps:

  • Adobe has released a hotfix for CVE-2026-75650 to address the critical vulnerability affecting Adobe Commerce and Magento Open Source.
  • The security update has been assigned a Priority 1 rating, indicating that it requires immediate attention.
  • Adobe recommends that affected users update their installations to the newest available version and apply the relevant hotfix as soon as possible.
  • Merchants and development teams should review Adobe’s installation instructions and test the update in a staging environment before deploying it to production.
  • Applying the hotfix promptly is essential to reduce the risk of exploitation and protect affected Magento and Adobe Commerce environments.

Why This Matters

The vulnerability addressed in APSB26-146 could allow unauthenticated attackers to execute arbitrary code on affected Magento and Adobe Commerce installations. As Adobe has confirmed active exploitation in the wild, applying the available security hotfix promptly is essential to help protect sensitive data, store operations, and the overall security of the eCommerce environment.

  • The vulnerability addressed in APSB26-146 is rated critical, with a CVSS base score of 10.0, representing the highest severity level.
  • Successful exploitation could result in arbitrary code execution, potentially allowing attackers to execute malicious code on an affected system.
  • The vulnerability does not require authentication, meaning an attacker may be able to exploit an affected installation without valid user credentials.
  • Adobe has confirmed that CVE-2026-75650 is being exploited in the wild, making the threat an active security concern rather than a theoretical risk.
  • Because the vulnerability can be exploited remotely and without authentication, delaying the security update could leave affected Adobe Commerce and Magento Open Source stores exposed to potential attacks.
  • Promptly applying the available hotfix is strongly recommended to help protect store data, application functionality, and the overall security of the eCommerce environment.

Vulnerability Details

The Adobe Security Bulletin APSB26-146 addresses CVE-2026-75650, a critical vulnerability classified as Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336).

If successfully exploited, the vulnerability could result in arbitrary code execution. Adobe has assigned the issue a CVSS base score of 10.0, representing the highest severity level.

The vulnerability can be exploited without authentication, meaning an attacker does not need valid user credentials to attempt exploitation. The CVSS vector also indicates that the vulnerability can be exploited remotely and requires low attack complexity.

The combination of remote exploitation, no authentication requirement, arbitrary code execution, and confirmed exploitation in the wild makes this vulnerability particularly serious. Organizations running affected versions of Adobe Commerce or Magento Open Source should review their environments and apply Adobe’s hotfix for CVE-2026-75650 without delay.