CVE-2026-75650 is an unauthenticated remote code execution flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe rates it CVSS 3.1 10.0 and states in its APSB26-146 bulletin, published September 7, 2026: “Adobe is aware of CVE-2026-75650 being exploited in the wild.” Adobe’s urgent advisory says the exploitation targeted Adobe Commerce merchants. That status comes from Adobe’s September 2026 publications, not from a live incident count.
The fix is Adobe’s version-matched VULN-39341 hotfix, followed by rotation of the encryption key and every credential that could have been exposed. Patching closes the hole; it does not prove a store that was already reachable is clean.
As an Amazon Associate I earn from qualifying purchases.
What the vulnerability is
Adobe classifies the issue as improper neutralization of special elements used in a template engine (CWE-1336). The impact is arbitrary code execution. The bulletin lists the vector as AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no user interaction, changed scope, and high impact on confidentiality, integrity and availability. In practice, an attacker needs no login. NVD carries an additional description of the record, but Adobe controls which patch applies to which product.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is your installation affected?
Adobe’s APSB26-146 lists these releases, “2026-aug and earlier” in each line:
#1 Best Overall
- Create and edit PDFs. Collaborate with ease. E-sign documents and collect signatures. Get everything done in one app, wherever you go.
- Edit text and images without jumping to another app.
- E-sign documents or request e-signatures on any device. Recipients don’t need to log in to e-sign.
- Convert PDFs to editable Microsoft Word, Excel, or PowerPoint documents.
- Share PDFs for collaboration. Commenting features make it easy for reviewers to comment, mark up, and annotate.
| Product | Affected release lines (2026-aug and earlier) |
|---|---|
| Adobe Commerce | 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4 |
| Adobe Commerce B2B | 1.5.3, 1.5.2, 1.4.2, 1.3.4, 1.3.3 |
| Magento Open Source | 2.4.9, 2.4.8, 2.4.7, 2.4.6 |
Adobe’s hotfix article states that compatibility was extended to Adobe Commerce and Magento Open Source 2.4.4 through 2.4.7. If you run a version older than those listed, check Adobe’s live bulletin; this article cannot tell you the status of unlisted releases. Because Adobe says it is not easy to tell whether the issue was patched, assume any listed release without a verified hotfix is exposed.
Choose the correct hotfix archive
Adobe does not ship one archive for everyone. Its urgent hotfix article (last updated September 21, 2026) maps release families to downloads:
- For the listed 2026-Aug/Jul and recent patch releases:
Hotfix VULN-39341-composer-patches.zip - Older branches have distinct archives, including
VULN-39341_248-p3.patch.zip,VULN-39341_248-p1.patch.zip,VULN-39341_247-p8.patch.zip,VULN-39341_247-p5.patch.zip,VULN-39341_246-p13.patch.zipandVULN-39341_246-p11.patch.zip
Find your exact version and patch level (for example in composer.json and your deployment records), then match it against Adobe’s full table. Do not copy a filename from a different release branch, and recheck the live table before you download, since coverage and artifacts can change.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Apply the hotfix
Adobe’s instruction is to unzip the downloaded file and follow its Composer patch application guidance, which the hotfix article links. Use that procedure for your deployment type rather than improvised file copying, and run it through your normal staging-then-production path if time allows. Given active exploitation, do not let the staging step delay production for long.
Verify the patch
For Adobe Commerce on Cloud, Adobe’s example uses the Quality Patches Tool:
vendor/bin/magento-patches -n status | grep "39341|Status"The expected output shows VULN-39341 with status Applied. Adobe presents this specifically for Cloud merchants; it is not stated as universal verification for every deployment mode. For on-premises installs, confirm via your Composer patch application results and deployment records that the correct archive for your branch was applied.
Rank #3
Rotate the encryption key and credentials
The encryption key protects integration tokens, payment gateway credentials and system-privileged automation tokens. Adobe warns explicitly that rotating the key does not invalidate credentials that may already have been exposed, so each credential must also be changed at its source. A payment gateway key, for example, must be reissued by the gateway, not only re-saved in Commerce.
Adobe’s sequence
- Apply the VULN-39341 hotfix.
- Enable maintenance mode and disable cron (on Commerce on Cloud:
vendor/bin/ece-tools cron:disable). - Rotate the encryption key.
- Rotate all Admin panel passwords.
- Deactivate and regenerate REST, SOAP and GraphQL integration tokens.
- Rotate OAuth client secrets.
- Rotate payment gateway API credentials at the providers.
- Rotate database and Fastly credentials.
- Rotate SSH and deploy keys.
- Rotate cron and other privileged service-account credentials.
- Rotate shipping, tax and other integrated extension API keys.
- Flush the cache.
- Re-enable cron (on Cloud:
vendor/bin/ece-tools cron:enable) and disable maintenance mode. - On Cloud, redeploy so the new database credentials take effect.
Adobe’s live article is authoritative for exact commands and ordering; your own runbooks govern change sequencing for non-Cloud setups. Plan the credential list in advance, since many items are owned by other teams or vendors.
The September Isolated patch is separate
Adobe’s September 2026 guidance says the APSB26-138 Isolated security patch does not include the APSB26-146 hotfix. Either may be applied first, with no required order, but Adobe recommends applying the CVE hotfix promptly because exploitation is active. Installing the Isolated patch does not protect you from this CVE.
If you may already have been compromised
Adobe’s guidance covers remediation, not forensic clearance. Nothing in it establishes that a store is clean after patching. If your store was internet-facing and unpatched while exploitation was active, treat compromise as possible: preserve logs and file snapshots before making sweeping changes where feasible, review for unexpected files, admin users, and modified code, and consider engaging an incident-response specialist if you lack in-house expertise. That is general security practice rather than an Adobe-specified procedure. Rotating credentials is still necessary, since anything stored in or reachable from the application may have been read.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
