# CVE-2026-75650: Adobe Commerce - RCE

> Live exploitation tracking for CVE-2026-75650 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-75650

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Adobe Commerce, Adobe Commerce B2B, Adobe Magento Open Source
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** ecommerce, php

## Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.

## CrowdSec analysis

[CVE-2026-75650](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-75650) is a critical template engine injection vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An unauthenticated remote attacker can exploit the flaw without user interaction to execute arbitrary code, potentially compromising confidentiality, integrity, and availability across affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-75650 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-75650 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-75650 is currently experiencing high visibility and active exploitation across the internet.

The exploit targets Magento’s email-template component by supplying a crafted template containing PHP code to the real email-template model, where vulnerable report storage and rendering allow component-level code execution.

## Timeline

- 2026-09-07: CVE Published. CVE-2026-75650 is published to NVD.
- 2026-09-08: CISA KEV. CVE-2026-75650 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-09-09: Rule Released. CrowdSec releases a rule to detect CVE-2026-75650 exploitation attempts against the CrowdSec Network.
- 2026-09-09: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-75650 for the first time.
- 2026-09-11: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://helpx.adobe.com/security/products/magento/apsb26-146.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-75650) follows observed exploitation activity for CVE-2026-75650. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.