Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-75650

CVE-2026-75650CRITICAL

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0395   90.1   YES

AFFECTED
  Product              Versions     Fixed
  Adobe Commerce       unspecified  Hotfix for CVE-2026-7565
  Adobe Commerce B2B   unspecified  Hotfix for CVE-2026-7565
  Magento Open Source  unspecified  Hotfix for CVE-2026-7565

TIMELINE
  Aug 18  Reserved by adobe
  Sep 7   Published (CNA: adobe)
  Sep 8   ADDED TO KEV — CVE-2026-75650 (Adobe Commerce). Remediation due September 11, 2026.
  Sep 12  DUE DATE PASSED — CVE-2026-75650 (Adobe Commerce). CISA remediation deadline was September 11, 2026; still in catalog.

CWE-1336 · CNA: adobe · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due September 11, 2026

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 18, 2026	Reserved	Reserved by adobe
September 7, 2026	Published	Published (CNA: adobe)
September 8, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-75650 (Adobe Commerce). Remediation due September 11, 2026.
September 12, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-75650 (Adobe Commerce). CISA remediation deadline was September 11, 2026; still in catalog.

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Adobe	Adobe Commerce	—	—	Hotfix for CVE-2026-7565
Adobe	Adobe Commerce B2B	—	—	Hotfix for CVE-2026-7565
Adobe	Magento Open Source	—	—	Hotfix for CVE-2026-7565

Weaknesses

CWE-1336

References (2)

https://helpx.adobe.com/security/products/magento/apsb26-146.html [Patch, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650 [US Government Resource]

Authoritative record: CVE-2026-75650 at cve.org

Vendors: adobe

Weaknesses: CWE-1336

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-75650 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.