Adobe Commerce template RCE, exploited (CVE-2026-75650) [PoC]

Actively exploited in the wild - CVE-2026-75650 is a critical arbitrary code execution vulnerability in Adobe Commerce versions 2.4.7 and earlier that lets unauthenticated attackers run arbitrary code on the server. Adobe has released a patched version; apply the latest security update immediately.

Overview

CVE-2026-75650 stems from improper neutralization of special elements used in Adobe Commerce’s template engine. An attacker can inject malicious template directives that the server processes, resulting in arbitrary code execution in the context of the current user. The vulnerability requires no user interaction and no privileges, making it remotely exploitable over the network.

The vulnerability carries a CVSS score of 10.0 (Critical). The scope is marked as “changed,” meaning an attacker who compromises the application can pivot to access resources beyond the initial target. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

While the EPSS model predicts only a 0.7% probability of exploitation in the next 30 days, that statistical likelihood does not account for the confirmed CISA KEV status. Threat actors are already leveraging this bug, so the practical urgency is far higher than the EPSS score suggests.

Affected Systems

Adobe Commerce is the e-commerce platform behind Magento and Adobe Commerce cloud deployments. All versions up to and including 2.4.7 are affected. Administrators running either the on-premises Magento Open Source edition or the Adobe Commerce cloud edition should treat their installations as at risk.

Remediation

Adobe has released security updates addressing CVE-2026-75650. Take the following steps:

1. Apply the latest Adobe Commerce security patch immediately. Check the Adobe Security Bulletin for your specific version (2.4.7, 2.4.6, or earlier) and upgrade to the patched release.
2. If you cannot patch immediately, restrict network access to the admin panel and application endpoints as a temporary mitigation.
3. Review server logs for signs of template injection or unexpected code execution activity.
4. Monitor for indicators of compromise, as the vulnerability may already be exploited in your environment.

For ongoing coverage of this and related threats, see the latest security news and check breach reports for documented attack campaigns.

Security Insight

Adobe Commerce has become a recurring target for ransomware groups and Magecart-style credit card skimmers, largely because unpatched e-commerce platforms offer direct access to payment data and customer PII. This template engine flaw stands out because it requires no authentication, meaning a single unpatched storefront can be compromised in seconds. The rapid inclusion in CISA’s KEV catalog suggests attackers are weaponizing this faster than typical e-commerce vulnerabilities, reinforcing that patching cadence, not just patch availability, is the difference between a minor incident and a full data breach.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs