Adobe Commerce - RCE (CVE-2026-75650)
Description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.
psychologyCrowdSec Analysis
CVE-2026-75650 is a critical template engine injection vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An unauthenticated remote attacker can exploit the flaw without user interaction to execute arbitrary code, potentially compromising confidentiality, integrity, and availability across affected systems.
CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2026-75650 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-75650 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
The exploit targets Magento’s email-template component by supplying a crafted template containing PHP code to the real email-template model, where vulnerable report storage and rendering allow component-level code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-07 |
| CISA KEV | 2026-09-08 |
| Rule Released | 2026-09-09 |
| CrowdSec First Seen | 2026-09-09 |
| CISA Remediation Deadline | 2026-09-11 |