CVE-2026-75650, CVSS 10.0, affects Adobe Commerce and Magento. NVD published it on 7 September 2026. CISA added it to the Known Exploited Vulnerabilities catalogue the very next day, 8 September — one of the fastest disclosure-to-confirmed-exploitation turnarounds in this window of KEV additions.
What it is
Per NVD, the flaw is an improper neutralization of special elements used in a template engine — CWE-1336, server-side template injection — that "could result in arbitrary code execution in the context of the current user." The CVSS vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, is network-reachable, low complexity, no privileges, no interaction, full compromise of confidentiality, integrity and availability, and a scope change.
Template injection means the application takes attacker-influenced input and passes it into a template engine that evaluates it as executable template syntax rather than as inert data. Unlike a straightforward code-injection bug, this class often lives in a feature nobody thinks of as an execution surface — a personalisation field, a dynamic email template, a themeable content block — because the developer's mental model of the feature is "insert some data into a template," not "hand the template engine a string it will interpret as instructions."
Where template injection tends to hide in an e-commerce codebase
Adobe Commerce and Magento are both built around a heavily templated rendering layer — product pages, category listings, checkout flows, and marketing emails are all assembled from templates that merge store data with layout markup. That architecture is precisely what makes CWE-1336 so dangerous here specifically: a template-injection bug does not need to compromise a rarely-used admin panel. It can live in any feature that lets store data — a product description, a customer's saved name, a promotional message an admin configures — flow into a template that later gets rendered for every visitor to a page.
The scope change in the CVSS vector (S:C) reflects exactly this: the vulnerable component is the template engine, but the impact is not confined to it. Once an attacker can make the engine evaluate arbitrary template syntax, the "current user" context NVD's description mentions is frequently the process running the storefront itself — meaning code execution in the context of whatever privileges the web server process holds, which on a default Commerce or Magento deployment can include read and write access to configuration files, session storage, and in some deployment patterns, the database credentials needed to reach customer and order data directly.
Why the one-day gap to KEV is itself informative
A one-day gap between an NVD publication and a KEV listing means exploitation was either already underway before the public record caught up, or the vulnerability was disclosed with enough detail — a proof of concept, a technical writeup — that a working exploit followed within hours. Either reading points to the same operational fact: for an e-commerce platform at CVSS 10.0, there was effectively no window between "this is public" and "this is being used."
Adobe Commerce and Magento run a substantial share of mid-market and enterprise online storefronts, which makes any critical, unauthenticated RCE against the platform immediately attractive at scale — a working exploit is not aimed at one store, it's aimed at every reachable instance of the same platform version, and automated scanning finds those instances quickly once a CVE this severe becomes public.
What to check this week
Patch immediately if you have not already — the one-day gap between disclosure and confirmed exploitation removes any argument for a normal patch-review cycle here.
Check order and customer data integrity for the window between 7 and 8 September, and for any period after during which the instance remained unpatched. An e-commerce platform compromise's most damaging outcome is frequently silent — payment skimming or data exfiltration that doesn't interrupt the storefront's apparent normal operation.
Review any custom template or theming code for the same template-injection pattern. CVE-2026-75650 is Adobe's own code; a store with custom extensions built on the same template engine may carry an equivalent, unpatched flaw in code nobody has audited for this specific bug class.
How Safeguard helps
Safeguard's continuous inventory flags e-commerce and content-management platforms the moment a critical CVE is published against the version in use, closing the gap between disclosure and awareness that, in this case, exploitation closed in under 24 hours. Reachability analysis then confirms whether the vulnerable template-rendering path is actually exposed on a given storefront, which matters as much for custom theming code built on the same engine as it does for the platform vulnerability itself.
