Template injection in Adobe products - CVE-2026-75650
Published: September 7, 2026
Vulnerability identifier: #VU147353
CSH Severity: Critical
CVSS v4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2026-75650
CWE-ID: CWE-1336
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper validation of untrusted input. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected application and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
How to mitigate CVE-2026-75650
Install a hotfix from vendor's website:
https://repo.magento.com/patch/VULN-39341-composer-patches.zip