CVE-2026-75650
CRITICAL · 10.0 KEV EPSS 2.1%KEV-confirmed active exploitation, vendor emergency patch released, no speculation present.
What: Adobe Commerce and Magento template engine injection vulnerability (CVE-2026-75650) allowing unauthenticated arbitrary code execution; CVSS 10.0 CRITICAL.
Why it matters: KEV-listed as of 2026-09-08 with active in-the-wild exploitation confirmed. Adobe released emergency hotfix. Multiple vendor versions affected (Commerce B2B, Commerce, Magento Open Source). No user interaction required; scope changed indicates privilege escalation risk.
Where it's seen: Security digest and threat intelligence feeds flagging immediate patching need. Adobe emergency patch released. Dubbed "StyleSmuggler." Defenders triaging patch applicability across Magento/Commerce deployments.
RISK: CRITICAL — Unauthenticated RCE, KEV-listed, actively exploited in-the-wild, CVSS 10.0, emergency patch deployed.
Description
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High