Published Tuesday, September 08, 2026 at 11:19 AM PT
BLUF: Adobe has released an emergency patch for CVE-2026-75650, a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source. Attackers are actively exploiting this in the wild to deploy backdoors. Organizations running affected Magento instances must patch immediately; this poses a critical compromise risk.
DETAILS
- Vulnerability: Unauthenticated remote code execution (RCE) in Adobe Commerce and Magento Open Source; CVSS score 10.0 (maximum severity)
- Exploitation Status: Confirmed active in the wild; attackers using it for backdoor deployment
- Availability: Adobe has released an emergency security update; patch availability confirmed
- Attack Vector: Remote, no authentication required — any internet-facing Magento instance is at risk
- Affected Versions: Adobe Commerce and Magento Open Source (specific version range not fully detailed in available advisory; refer to Adobe’s official patch bulletin for complete version matrix)
IMPACT
Magento is widely used for e-commerce and marketplace deployments. Organizations running either Adobe Commerce or Magento Open Source are directly exposed. Successful exploitation allows unauthenticated attackers to execute arbitrary code on affected servers, leading to data exfiltration, persistent backdoor installation, payment card compromise (on payment-processing instances), and full infrastructure takeover. Organizations hosting Magento for third parties amplify the blast radius.
RECOMMENDED ACTIONS
- Immediate (today): Identify all systems running Adobe Commerce or Magento Open Source in your environment; prioritize public-facing instances
- Critical patching: Apply Adobe’s emergency security update immediately; do not delay for testing cycles given active exploitation
- Incident detection: Monitor for suspicious outbound connections, unexpected code execution, and access to sensitive commerce data; check logs for exploitation attempts (typically involve payload delivery to web-accessible endpoints)
- If compromise suspected: Assume backdoor presence; isolate affected systems, revoke admin credentials, and conduct full forensics; consider ransomware/data exfiltration vectors simultaneously
SOURCES
SOC Prime threat alert
NOTE: Specific affected version numbers could not be extracted from the available advisory text (source data truncated). Immediately reference Adobe’s official security bulletin for complete version scope before patching.
Recent high-severity events at publish time:
