DEV Community

kozhevniko
kozhevniko

Posted on

Why CVE-2026-75650 Matters More Than Its CVE Number Suggests

#security #vulnerability #adobe #magento

Why CVE-2026-75650 Matters More Than Its CVE Number Suggests

Patch advisories arrive in bulk, and bulk advisories train teams to skim. CERT-In's CIVN-2026-0458 is exactly that kind of document: a long list of Adobe products, a long list of CVEs, and a single CRITICAL rating covering all of them. The risk in skimming it is that one entry deserves a different response from the rest.

The one line that changes the priority

Buried in the description is a sentence that separates CVE-2026-75650 from its neighbours: it affects Adobe Commerce, Adobe Commerce B2B and Magento Open Source, it is a critical remote code execution vulnerability, it can be exploited by an unauthenticated remote attacker, and Adobe has confirmed it is being exploited in the wild.
Each of those clauses raises the priority independently. Together they describe a pre-authentication RCE in an internet-facing commerce platform that is already under active attack.

What "unauthenticated" actually buys an attacker

Most critical vulnerabilities require some foothold: a valid session, a low-privilege account, or a user who can be induced to open a file. CVE-2026-75650 does not. The CERT-In note states plainly that an unauthenticated remote attacker can execute arbitrary code on a vulnerable server.
For defenders this collapses the usual detection opportunities. There is no failed login to alert on, no privilege-escalation step to catch, and no user interaction to prevent. The attack surface is whatever the commerce application exposes to the network, and the exploitation window opens the moment the host is reachable.

The affected commerce line

The versions CERT-In lists for the commerce products are:

  • Adobe Commerce 2.4.4 through 2.4.9-2026-aug and earlier releases.
  • Adobe Commerce B2B 1.3.3 through 1.5.3-2026-aug and earlier releases.
  • Magento Open Source 2.4.6 through 2.4.9-2026-aug and earlier releases. Adobe Commerce and Magento Open Source share a common codebase lineage, which is why a single flaw can span both the commercial and open-source editions along with the B2B extension.

Sizing the reachable population

A ZoomEye search for app="Magento" returned 132,158 assets. That number describes hosts matching the Magento fingerprint on the public internet. It does not tell you which of them run a vulnerable release, and it does not confirm exploitability. It does tell you that the product family is widely deployed and widely reachable, which is the condition that makes an unauthenticated RCE worth prioritising over a comparable bug in a niche component.
A query for vul.cve="CVE-2026-75650" returned zero results, consistent with a CVE that is too new for ZoomEye's identifier index. A zero here is not evidence of low exposure; it is evidence that the identifier-based query is not yet useful.

Remediation

The fix is the vendor update. CERT-In references the Magento bulletins apsb26-138 and apsb26-146. Apply them to every Adobe Commerce, Commerce B2B and Magento Open Source deployment, then verify the running version. Because exploitation is confirmed in the wild, pair the patch with a compromise assessment on internet-facing hosts: review administrative accounts, template and file modifications, and outbound network activity for signs that the flaw was already used.

References

Top comments (0)