Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)

Affected Vendors

Adobe

Affected Components

Adobe Commerce, Magento Open Source

Published Date

2026-09-07

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All unpatched versions of Adobe Commerce and Magento Open Source.

Impact

Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.

Mitigation

Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.

Affected Products & Version Scope

Adobe Commerce 2.4.7 and earlier, Magento Open Source 2.4.7 and earlier. This includes both on-premise and cloud deployments.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply Official Patches: Follow the instructions in Adobe Security Bulletin APSB26-146 to update your installation.

bash

# Example update via Composer
composer update magento/product-community-edition --with-dependencies
bin/magento setup:upgrade
bin/magento cache:clean

WAF Implementation: Deploy WAF rules to detect and block common SSTI payloads containing sequences like {{, }}, var, or PHP execution functions.
File Integrity Monitoring (FIM): Monitor for unauthorized changes in the app/code or vendor directories which may indicate post-exploitation persistence.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This is a high-priority threat with an EPSS score of 0.94. Immediate patching is mandatory to prevent automated exploitation.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

CVE-2026-75650 is a critical Server-Side Template Injection (SSTI) vulnerability (CWE-1336) within the Adobe Commerce template engine. It arises from improper neutralization of special elements in user-supplied input used in templates. An attacker can exploit this to bypass the template sandbox and execute arbitrary code in the context of the web server. With a CVSS score of 10.0 and inclusion in the CISA KEV catalog, this vulnerability is being actively exploited in the wild. The 'Scope Changed' (S:C) designation indicates that the impact extends beyond the template engine itself, potentially compromising the entire underlying operating system.

Official Vendor Advisories & References

NVD Original English Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

https://helpx.adobe.com/security/products/magento/apsb26-146.html

Source: psirt@adobe.com · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: