On 7 September 2026 Adobe shipped an emergency hotfix for Adobe Commerce and Magento Open Source. CVE-2026-75650, a template engine injection that can lead to arbitrary code execution, was already being exploited, and Adobe said so in bulletin APSB26-146. CISA added it to the Known Exploited Vulnerabilities catalog the next day, 8 September, with a due date of 11 September.
A second Commerce CVE followed. On 24 September CISA added CVE-2026-71362, an incorrect authorization flaw that Adobe had patched on 11 August in APSB26-92, with a due date of 27 September. When Adobe published that bulletin it said it was not aware of exploits. CISA's listing says that has changed.
What's affected
CVE-2026-75650 (APSB26-146, priority 1, CWE-1336):
- Adobe Commerce 2.4.4 through 2.4.9, up to and including the
2026-augreleases of each line. - Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, up to their
2026-augreleases. - Magento Open Source 2.4.6 through 2.4.9, up to their
2026-augreleases. - Fix: a hotfix, not a new release. Adobe's knowledge base article says an unauthenticated attacker could execute arbitrary code, and that you must apply the patch and rotate your encryption keys.
CVE-2026-71362 (APSB26-92, priority 2, CWE-863):
- CVSS 3.1 score 9.1. No authentication required, no admin privileges required. Impact is privilege escalation.
- Affected: Commerce and Magento Open Source
2026-julreleases and earlier, and Commerce B2B2026-juland earlier. - Fixed: the
2026-augreleases, for example 2.4.9-2026-aug and 2.4.8-2026-aug, and B2B 1.5.3-2026-aug.
Note the overlap. Installing the August release fixes CVE-2026-71362, but the August releases are still listed as affected by CVE-2026-75650. You need both the August update and the hotfix.
Adobe's hotfix files by version, from its knowledge base:
| Your version | Hotfix file |
|---|---|
| All 2026-aug and 2026-jul releases; 2.4.8-p4, p5; 2.4.7-p9, p10; 2.4.6-p14, p15; 2.4.5-p16, p17; 2.4.4-p17, p18 | VULN-39341-composer-patches.zip |
| 2.4.8-p2, 2.4.8-p3 | VULN-39341_248-p3.patch.zip |
| 2.4.8, 2.4.8-p1 | VULN-39341_248-p1.patch.zip |
| 2.4.7-p7, 2.4.7-p8 | VULN-39341_247-p8.patch.zip |
| 2.4.7 to 2.4.7-p6 | VULN-39341_247-p5.patch.zip |
| 2.4.6-p12, p13; 2.4.5-p14, p15; 2.4.4-p15, p16 | VULN-39341_246-p13.patch.zip |
| 2.4.6 to 2.4.6-p11; 2.4.5 to 2.4.5-p13; 2.4.4 to 2.4.4-p14 | VULN-39341_246-p11.patch.zip |
How to check if you're exposed
Get the version:
bin/magento --version
composer show magento/product-community-edition magento/product-enterprise-edition 2>/dev/null | grep -i versions
Check whether the CVE-2026-75650 hotfix is applied. Adobe's documented check for Commerce on Cloud uses the Quality Patches Tool:
vendor/bin/magento-patches -n status | grep "39341\|Status"
You want VULN-39341 to show Applied. On self-managed installs that applied the patch through Composer, confirm the patch is listed in your composer.json patches section and that the deploy that included it actually reached production.
Adobe did not publish indicators for either CVE. Hunt for what an attacker would do after code execution or privilege escalation on a store:
- New admin users, or admin role changes nobody requested, in the
admin_usertable. - New or changed REST, SOAP or GraphQL integrations under System, Extensions, Integrations.
- Recently changed CMS blocks, templates or
core_config_datarows that add script tags, a common skimmer placement. - Recently modified
.phpfiles underpub/,app/orvendor/.
What to do now
- Install the August 2026 security release for your line to close CVE-2026-71362.
- Apply the VULN-39341 hotfix for your version to close CVE-2026-75650. Confirm it with
magento-patchesor your Composer patch list. - Rotate the encryption key, then rotate everything it protected. Adobe's guidance is explicit: rotating the key alone does not invalidate credentials that may already have leaked. Its list covers admin passwords, REST, SOAP and GraphQL integration tokens, OAuth client secrets, payment gateway API credentials at the provider, database credentials, SSH and deploy keys, and API keys for shipping, tax and other extensions.
- Follow Adobe's order of operations: enable maintenance mode, disable cron, rotate, flush cache, re-enable cron, disable maintenance mode. On Commerce on Cloud, redeploy to pick up new database credentials.
- Review the hunting items above for activity since late August. If you find a skimmer or a rogue admin, treat payment data handling as an incident and involve your payment provider.
Why it matters
Commerce platforms hold the two things attackers want most from a website: payment flows and stored credentials for payment gateways. A code execution bug there is rarely used for noise. It is used quietly, to skim cards or steal keys that work long after the patch.
That is why Adobe's guidance goes past patching. The encryption key protects integration tokens and gateway credentials, so if code ran on the server, those secrets should be treated as gone. Patching closes the door. Rotation takes back what may already have left.
Try it yourself
Take your store's composer.lock and list every third party module and its version. Modules run with the same rights as core code, so they belong in the same patch process. Export the list as a CycloneDX SBOM if your tooling supports it and review it alongside the core update.
This demo shows how to prioritize fixes when a vendor ships both releases and hotfixes:
Click through it at your own pace, or open it full screen.
Quick check
Does installing 2.4.9-2026-aug fix both CVEs?
No. The August release fixes CVE-2026-71362, but APSB26-146 lists the August releases as affected by CVE-2026-75650. Apply the VULN-39341 hotfix too.
Is rotating the encryption key enough after applying the hotfix?
No. Adobe says rotating the key does not invalidate credentials that may already have been exposed. Rotate the credentials themselves at their source, including payment gateways.
Does CVE-2026-71362 need an admin account?
No. Adobe lists it as requiring no authentication and no admin privileges, with a CVSS 3.1 score of 9.1.
