Adobe has issued an urgent security update for Adobe Commerce and Magento after identifying a severe zero-day vulnerability that allows unauthenticated remote code execution. The flaw, designated CVE-2026-75650, has already been exploited in active attacks, prompting the company to release a hotfix and assign the highest remediation priority.
The vulnerability arises because the template engine fails to properly neutralize special elements, enabling attackers to inject and execute arbitrary code remotely without requiring any credentials. Adobe published its security advisory on September 7, 2026, classifying the issue as Critical — the highest of its three-tier severity scale.
Under the CVSSv3.1 scoring system, the vulnerability received the maximum base score of 10.0, confirming its extreme risk level. Adobe states that real-world exploitation has been observed, which significantly raises the urgency for organizations running affected versions.
To address the issue, Adobe has prepared a dedicated hotfix that resolves CVE-2026-75650. The company rates the update priority as 1 on its three-tier scale and recommends applying the patch within 72 hours whenever possible.
Customers are strongly advised to review the official Adobe security advisory and deploy the fix immediately to prevent potential compromise of their e-commerce platforms.
