DEV Community

jeffrey
jeffrey

Posted on

Adobe Commerce RCE CVE-2026-75650: An Unauthenticated Path Into the Storefront

#security #vulnerability #adobe #magento

Adobe Commerce RCE CVE-2026-75650: An Unauthenticated Path Into the Storefront

CERT-In's vulnerability note CIVN-2026-0458, published on September 16, 2026, bundles a wide Adobe patch wave under a CRITICAL severity rating. Most of the individual bugs are the usual mix of memory-safety and input-validation defects. One stands out because Adobe has confirmed it is already being used against real systems: CVE-2026-75650, a remote code execution flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that an unauthenticated remote attacker can trigger.

Vulnerability overview

CVE-2026-75650 is a critical remote code execution issue. According to the CERT-In note, it "can be exploited by an unauthenticated remote attacker to execute arbitrary code on a vulnerable server," and the note explicitly states that Adobe has confirmed in-the-wild exploitation. The affected product family is the e-commerce platform line: Adobe Commerce, Adobe Commerce B2B and Magento Open Source.
The severity rating for the overall advisory is CRITICAL. CERT-In classifies the risk as arbitrary code execution, privilege escalation, security feature bypass, sensitive information disclosure and full compromise of affected systems.

Mechanism and exploitation conditions

The public advisory material does not disclose the precise vulnerable component or the exact request that triggers CVE-2026-75650, so this article does not invent those details. What the reliable source does establish is the exploitation precondition that matters most for defenders: authentication is not required. An attacker who can reach the application over the network is operating in the same trust position as any anonymous visitor.
That is the defining characteristic of a pre-authentication RCE. It removes the credential barrier that normally narrows the attacker pool, and it means the vulnerable code path is reachable from the public internet rather than from an authenticated administrative session. For a commerce platform, the reachable surface includes the storefront, checkout flows and any exposed API endpoints.

Impact

Successful exploitation allows arbitrary code execution on the server. In an e-commerce deployment, that is not an abstract loss of integrity. The application server typically holds database credentials, payment integration secrets, customer records and administrative session material. Code execution therefore converts directly into data theft, fraudulent transactions and a durable foothold inside the network.
The CERT-In note groups the potential outcomes as arbitrary code execution, privilege escalation, unauthorized access to or modification of files and sensitive information, security feature bypass and denial-of-service conditions. Because exploitation is confirmed in the wild, the practical risk is not hypothetical.

Affected products and scope

CERT-In lists the following affected versions for the commerce line:

  • Adobe Commerce 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier, 2.4.5-2026-aug and earlier, and 2.4.4-2026-aug and earlier.
  • Adobe Commerce B2B 1.5.3-2026-aug and earlier, 1.5.2-2026-aug and earlier, 1.4.2-2026-aug and earlier, 1.3.4-2026-aug and earlier, and 1.3.3-2026-aug and earlier.
  • Magento Open Source 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, and 2.4.6-2026-aug and earlier. The same advisory covers many other Adobe products — Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Photoshop Mobile, Acrobat, Acrobat Reader and Campaign Classic — but CVE-2026-75650 is scoped to the Commerce and Magento Open Source products.

Exposure context

A ZoomEye query for the Magento application fingerprint, app="Magento", returned 132,158 matching assets at the time of writing. A separate query for vul.cve="CVE-2026-75650" returned zero, which is expected for a recently disclosed CVE that ZoomEye has not yet indexed by identifier.
The 132,158 figure describes assets that match the Magento fingerprint. It is a measure of the reachable product population, not proof that every one of those hosts is running a vulnerable version or is confirmed exploitable. Treat it as a sizing input for prioritisation, not as a vulnerability count.

Remediation and mitigations

Adobe has published vendor updates for the affected commerce products. CERT-In points to the Magento security bulletins apsb26-138 and apsb26-146 as the relevant fixes. The remediation steps are:

  1. Identify every Adobe Commerce, Commerce B2B and Magento Open Source instance in the estate, including staging and development copies that may be internet-reachable.
  2. Apply the vendor updates referenced by apsb26-138 and apsb26-146.
  3. Confirm the deployed version after patching rather than trusting the change ticket.
  4. Because exploitation is confirmed, treat internet-facing commerce hosts as potentially compromised and review them for indicators of post-exploitation activity, including unexpected administrative accounts, modified templates and outbound connections. Where immediate patching is not possible, reduce exposure by restricting network access to the application and its administrative and API endpoints, and by monitoring for anomalous requests to the commerce front end.

References

Top comments (0)