cyber.hendryadrian.com

CVE

CVE-2026-75650

First Reported
Sep 11, 2026
Latest Reported
Sep 11, 2026
Articles
1
View articles →
IOC
0
View indicators →

CVE Enrichment

CVSS
10.0 CRITICAL
EPSS
3.95%
EPSS Percentile
90.17%
CISA KEV
YES — Known Exploited Vulnerability

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Technical Details

CVSS Version
3.1
CNA / NVD Source
psirt@adobe.com
Published
08-Sep-2026 04:17
Last Modified
09-Sep-2026 12:18
EPSS Date
2026-10-11
CWE
CWE-1336

CVSS Vector

CVSS:3.1 AV:N / AC:L / PR:N / UI:N / S:C / C:H / I:H / A:H

CISA KEV Details

Date Added
2026-09-08
Remediation Due
2026-09-11
Known Ransomware Campaign Use
Unknown
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://helpx.adobe.com/security/products/magento/apsb26-146.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-75650

Affected Products / Versions

References

Last enrichment sync: 12-Oct-2026 19:51
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Malware (1)

StyleSmuggler1 related article

People (4)

Brian Krebs1 related articleCalif1 related articleMrBruh1 related articleuturn1 related article

Vendors (10)

Adobe1 related articleAT&T1 related articleBoston Scientific1 related articleClickHouse1 related articleCrowdStrike1 related articleIDScan.net1 related articleLG1 related articleOpenAI1 related articlePalo Alto Networks1 related articleTencent1 related article

Products (9)

Adobe Commerce1 related articleAgent Harness Security1 related articleAgentWorks1 related articleCortex1 related articleDevin1 related articleFalcon Guardian1 related articleGPT-6 Astra1 related articleMagento1 related articleWeChat1 related article

Tools (6)

Blue Solano1 related articleDaybreak1 related articleHybrid Analysis1 related articleMCP1 related articleOffensive Red Tempest1 related articleSafeMind1 related article

Industries (3)

Healthcare1 related articleRetail1 related articleTelecommunications1 related article

Countries (1)

United States1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.