SB20260907142 - Remote code execution in Adobe Commerce and Magento Open Source
Published: September 7, 2026 Updated: September 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Template injection (CVE-ID: CVE-2026-75650) Exploited
CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper validation of untrusted input. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected application and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
2) Incorrect authorization (CVE-ID: CVE-2026-77108)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to incorrect authorization in Adobe Commerce B2B authorization controls when handling requests. A remote attacker can exploit the authorization flaw to escalate privileges.
Only Adobe Commerce B2B is affected.
3) Incorrect authorization (CVE-ID: CVE-2026-77109)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to incorrect authorization in Adobe Commerce B2B authorization controls when handling requests. A remote attacker can exploit the authorization flaw to escalate privileges.
Only Adobe Commerce B2B is affected.
4) Incorrect authorization (CVE-ID: CVE-2026-77111)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass security features.
The vulnerability exists due to incorrect authorization in authorization controls when handling requests. A remote privileged user can exploit the authorization flaw to bypass security features.
5) Cross-site scripting (CVE-ID: CVE-2026-76201)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to stored cross-site scripting in Adobe Commerce and Magento Open Source when processing stored content. A remote attacker can submit crafted content to escalate privileges.
User interaction is required.
6) Cross-site scripting (CVE-ID: CVE-2026-76200)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to stored cross-site scripting in Adobe Commerce and Magento Open Source when processing stored content. A remote attacker can submit crafted content to escalate privileges.
User interaction is required.
7) Path traversal (CVE-ID: CVE-2026-77110)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass security features.
The vulnerability exists due to path traversal in pathname processing when processing pathnames. A remote privileged user can supply a crafted pathname to bypass security features.
8) Incorrect authorization (CVE-ID: CVE-2026-77774)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features.
The vulnerability exists due to incorrect authorization in authorization controls when handling requests. A remote attacker can exploit the authorization flaw to bypass security features.
9) Incorrect authorization (CVE-ID: CVE-2026-76202)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to incorrect authorization in authorization controls when handling requests. A remote attacker can exploit the authorization flaw to escalate privileges.
Remediation
Install update from vendor's website.