Adobe Commerce - RCE (CVE-2026-75650)
Description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.
psychologyCrowdSec Analysis
CVE-2026-75650 is a critical template engine injection vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An unauthenticated remote attacker can exploit the flaw without user interaction to execute arbitrary code, potentially compromising confidentiality, integrity, and availability across affected systems.
CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.
CrowdSec network data shows that most actors exploiting CVE-2026-75650 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-75650 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-75650 is currently experiencing high visibility and active exploitation across the internet.
The exploit targets Magento’s email-template component by supplying a crafted template containing PHP code to the real email-template model, where vulnerable report storage and rendering allow component-level code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-07 |
| CISA KEV | 2026-09-08 |
| Rule Released | 2026-09-09 |
| CrowdSec First Seen | 2026-09-09 |
| CISA Remediation Deadline | 2026-09-11 |