CVE-2026-75650: Adobe Commerce and Magento Template Engine Injection Enables Arbitrary Code Execution

Background

Adobe Commerce (formerly Magento Commerce) and Magento Open Source power a large share of the world’s online storefronts, from small merchants to large enterprise retailers. The platform’s template engine renders dynamic storefront and admin content — product pages, email templates, CMS blocks, and layout XML — by combining merchant-authored content with data drawn from the store’s catalog, customer, and order systems. Because e-commerce platforms directly process payment-adjacent data, customer PII, and sit at the center of a merchant’s revenue operations, a code-execution vulnerability here is both a direct path to data theft and a potential vector for supply-chain-style attacks against every customer who transacts on an affected storefront (such as web-skimming/Magecart-style card-theft injection).

Technical Mechanism

CVE-2026-75650 is classified under CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine — commonly known as server-side template injection (SSTI). CISA’s KEV description states that the flaw “could allow an attacker to execute arbitrary code” via improper neutralization of special elements in Adobe Commerce and Magento’s template engine.

SSTI vulnerabilities arise when user-controllable input (such as a product attribute, customer-supplied form field, CMS content, or an admin-configurable template value) is passed into a template-rendering function without properly distinguishing between literal data and template syntax that should be evaluated. If an attacker can get template-engine-specific syntax (such as the directive and variable-substitution syntax used by Magento’s layout XML and email/CMS templating system) into a field that is later rendered through the template engine, the engine will evaluate that syntax as code rather than treating it as inert text. Depending on the specific template context and what helper functions or objects are reachable from within the templating sandbox, this can escalate from simple data disclosure (reading internal object properties) to full arbitrary PHP code execution on the underlying server — particularly if the template context exposes objects or methods that allow invoking arbitrary system-level operations.

Given Adobe Commerce/Magento’s extensive use of CMS blocks, email templates, and customizable storefront content — many of which can be influenced indirectly through admin-configurable or even customer-facing input depending on store configuration — the specific injection point for this CVE is not detailed in the available data, but the vulnerability class itself is well understood: any template-rendering path that mixes untrusted input with template syntax evaluation is a candidate.

Real-World Exploitation Evidence

CVE-2026-75650 was added to CISA’s KEV catalog on 2026-09-08, confirming CISA has evidence of active exploitation in the wild as of that date. CISA’s data lists knownRansomwareCampaignUse as “Unknown” — CISA has not confirmed use of this vulnerability in ransomware campaigns at this time. No specific threat actor or named campaign has been publicly attributed to exploitation of this CVE in the data reviewed for this article; the KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Given Magento/Adobe Commerce’s history as a frequent target for Magecart-style payment-skimming campaigns following prior RCE disclosures (such as CVE-2022-24086), defenders should treat rapid, automated post-disclosure exploitation as a realistic pattern for this vulnerability class even though no specific campaign has yet been publicly tied to this particular CVE.

Impact Assessment

A CVSS score of 10.0 for arbitrary code execution reflects unauthenticated or low-barrier, network-exploitable compromise with complete impact to confidentiality, integrity, and availability:

• Full server compromise: Arbitrary code execution on the Commerce/Magento application server gives an attacker control equivalent to the web server process — enabling file system access, database access, and further lateral movement into the hosting environment.
• Payment and customer data exposure: E-commerce platforms process customer PII and are frequently integrated with, or adjacent to, payment processing. Attackers with code execution can install payment-skimming code (Magecart-style JavaScript injection) directly into checkout pages, harvesting card data from every customer who subsequently visits the compromised store.
• Multi-tenant/agency risk: Agencies and platform operators managing many Magento storefronts on shared infrastructure face amplified risk, as a single exploited instance can be a foothold into adjacent tenant environments depending on hosting isolation.
• Reputational and compliance impact: Payment card data exposure on e-commerce platforms triggers PCI-DSS compliance obligations and breach notification requirements, making this a high-priority remediation item beyond the pure technical severity.

Affected Versions

The KEV data does not include an explicit affected-version table. Organizations should consult Adobe’s security bulletin APSB26-146 (linked in References) for the definitive list of affected Adobe Commerce and Magento Open Source versions and the corresponding patched releases.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, consistent with BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.

1. Apply Adobe’s security patch from bulletin APSB26-146 to all affected Adobe Commerce and Magento Open Source installations.

   # Example: Magento/Adobe Commerce via Composer
   composer require magento/product-community-edition=<patched-version> --no-update
   bin/magento setup:upgrade
   bin/magento cache:flush

2. Review and restrict admin and customer-facing fields that feed into template rendering (CMS blocks, email templates, layout XML, custom attributes) for any unexpected template-syntax content that may already have been injected.
3. Scan storefront pages for unauthorized JavaScript or script injections consistent with web-skimming activity, particularly on checkout and payment pages, as a precaution regardless of whether exploitation is confirmed.
4. Rotate admin credentials and API integration tokens if there is any indication of prior exploitation or unauthorized admin access.
5. Evaluate internet exposure and admin-panel access controls — restrict the Magento Admin panel to trusted IP ranges or VPN access where feasible, reducing the attack surface for admin-reachable injection points.

Detection Guidance

• Web server and application logs: Review for requests containing template-engine-specific syntax (such as Magento’s {{...}} directive syntax or layout-XML special constructs) in parameters associated with CMS content, email templates, or customer-input fields.
• File integrity monitoring: Monitor theme, template, and media directories for unexpected file creation or modification, which can indicate a successful RCE-to-webshell chain.
• Storefront content monitoring: Periodically diff checkout and payment-page JavaScript/HTML against a known-good baseline to detect skimmer injection.
• Outbound network monitoring: Watch for unexpected outbound connections from the application server, which can indicate data exfiltration or a reverse shell following successful exploitation.
• Exact IOC and signature guidance should be sourced from Adobe’s bulletin and current threat-intelligence/WAF vendor feeds once published, as specific published signatures were not available in the data reviewed for this article.

Timeline

References

• Adobe Security Bulletin APSB26-146
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 — Forensics Triage Requirements Implementation Guidance
• NVD — CVE-2026-75650