Listen to this Post
- CVE-2026-75650 affects Adobe Commerce and Magento Open Source template processing.
- The weakness is CWE-1336, improper neutralization of special elements in a template engine.
- An attacker can supply template syntax that the application does not safely neutralize.
- The template engine may evaluate attacker-controlled content during rendering.
- This can result in arbitrary code execution in the context of the current user.
- Exploitation of this issue does not require user interaction.
- Scope is changed, meaning impact may cross security boundaries.
- Adobe Systems Incorporated is the source for the CVE record.
- NVD published the entry on Sep 07, 2026.
- NVD last modified the entry on Sep 09, 2026.
- CISA added the issue to the Known Exploited Vulnerabilities Catalog.
12. CISA added it on September 08, 2026.
13. CISA due date is September 11, 2026.
- Required action is applying mitigations per vendor instructions.
- BOD 26-04 guidance applies to prioritizing security updates.
- Cloud services must follow BOD 26-04 or discontinue use if mitigations are unavailable.
- Stakeholders must evaluate internet exposure and patching guidelines.
- Affected Adobe Commerce versions include up to 2.4.9-2026-aug.
- Affected Adobe Commerce B2B versions include up to 1.5.3-2026-aug.
- Affected Magento Open Source versions include up to 2.4.9-2026-aug.
- CPE data lists many Adobe Commerce 2.4.4 through 2.4.9 variants.
- CPE data lists Adobe Commerce B2B 1.3.3 through 1.5.3 variants.
- CPE data lists Magento Open Source 2.4.6 through 2.4.9 variants.
- The advisory references Patch and Vendor Advisory tags.
- A CISA-ADP reference is also provided as a US Government Resource.
- The vulnerability can execute arbitrary code as the current user.
- Template injection flaws often arise from unsafe rendering of user input.
- Proper neutralization must prevent template delimiters from being evaluated.
- Hotfixes for CVE-2026-7565 are listed as unaffected in the .
- Apply vendor hotfixes and monitor KEV guidance for CVE-2026-75650.
DailyCVE Form:
Platform: Adobe Commerce Magento
Version: Up to 2.4.9-2026-aug
Vulnerability: Template Engine Injection
Severity: Critical
date: Sep 07 2026
Prediction: 2026-09-11
(end of form)
What Undercode Say:
Analytics
php bin/magento --version composer show adobe/commerce --all composer show adobe/commerce-b2b --all composer show magento/product-community-edition --all grep -R "TemplateEngine" app/code vendor | head -20 grep -R "setTemplate" app/code vendor | head -20 grep -R "fetchView" app/code vendor | head -20
<?php
$input = $_GET['q'] ?? '';
$allowed = ['catalog', 'search', 'product'];
if (!in_array($input, $allowed, true)) {
throw new \InvalidArgumentException('Invalid template input');
}
echo $block->escapeHtml($input);
?>
Exploit: (Educational Purposes!)
Lab-only benign template marker; do not run on unauthorized systems
curl -s "https://lab.local/search?q={{77}}"
curl -s "https://lab.local/search?q=${77}"
Protection: from this CVE
composer update adobe/commerce adobe/commerce-b2b magento/product-community-edition php bin/magento setup:upgrade php bin/magento cache:flush php bin/magento indexer:reindex
Impact:
Arbitrary code execution in the current user context. No user interaction. Scope changed. CISA KEV catalog. Apply mitigations by September 11, 2026.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
