# CVE-2026-75650: Adobe Commerce and Magento improper neutralization in template engine

Source: https://junglewise.ai/threats/cve-2026-75650-adobe-commerce-and-magento-improper-neutralization-in-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-75650 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-09-07

Adobe Commerce and Magento are e-commerce platforms used by thousands of online retailers to manage their storefronts and customer transactions. A vulnerability in the template engine allows attackers to inject and execute malicious code, potentially leading to complete compromise of the platform, theft of customer data, and unauthorized control of the online store. This flaw is currently being actively exploited by attackers.

Technologies: [Adobe Commerce](https://junglewise.ai/threats/technologies/commerce), [Adobe Magento](https://junglewise.ai/threats/technologies/magento), [Adobe Magento Open Source](https://junglewise.ai/threats/technologies/magento-open-source). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-75650 exploited in the wild?** Yes. CVE-2026-75650 is known to be exploited in the wild, first recorded on 8 September 2026. Treat it as urgent.

**How severe is CVE-2026-75650?** Critical severity, with a CVSS score of 10, published 7 September 2026.

**Which products and versions are affected?** Adobe Adobe Commerce; Adobe Magento Open Source.

**Is there a fix for CVE-2026-75650?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75650 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75650?** Check whether you run Adobe Commerce, Adobe Magento or Adobe Magento Open Source. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability involves improper neutralization of special elements within a template engine used by Adobe Commerce and Magento Open Source. Template injection flaws occur when user-controlled input is not properly sanitized before being processed by the template engine, allowing attackers to inject malicious template syntax that gets evaluated as code. The vulnerability allows arbitrary code execution, which represents the highest severity of compromise. The fact that this vulnerability is being actively exploited in the wild indicates that attack methods are publicly known or easily discoverable. Patches or mitigations should be applied immediately to all affected instances.

## Affected products

- Adobe Adobe Commerce
- Adobe Magento Open Source

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: exploited

## Related threats

- [Adobe Commerce improper input validation in file write](https://junglewise.ai/threats/cve-2026-95631-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce improper input validation in security feature](https://junglewise.ai/threats/cve-2026-95630-adobe-commerce-is-affected-by-an-improper-input-validation)
- [Adobe Commerce stored XSS vulnerability in form fields](https://junglewise.ai/threats/cve-2026-92922-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce stored XSS in form fields](https://junglewise.ai/threats/cve-2026-92911-adobe-commerce-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Commerce incorrect authorization security feature bypass](https://junglewise.ai/threats/cve-2026-92910-adobe-commerce-is-affected-by-an-incorrect-authorization)