DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

A Defender's Checklist for CVE-2026-75650 in Adobe Commerce and Magento Open Source

#security #vulnerability #adobecommerce #magento

A Defender's Checklist for CVE-2026-75650 in Adobe Commerce and Magento Open Source

Vulnerability overview

CVE-2026-75650 is a critical, actively exploited vulnerability in Adobe Commerce and Magento Open Source. The ACSC classifies it as an Improper Neutralisation of Special Elements Used in a Template Engine resulting in unauthenticated remote code execution, with exploitation requiring the /graphql endpoint to be exposed. A vendor patch was released on 7 September 2026.

Step 1: Establish whether you are exposed

Inventory every Adobe Commerce and Magento Open Source deployment, including staging and pre-production systems that may share a public domain. For each, determine whether /graphql is reachable from the internet. That single question separates deployments that meet the advisory's exploitation condition from those that do not.

Step 2: Patch, and verify the patch

Apply the 7 September 2026 patch. Then verify it, rather than assuming it landed: confirm the deployed build, and check that no cached or blue-green variant is still serving the old code.

Step 3: Where patching lags, reduce the surface

If a deployment cannot be patched immediately, restrict and monitor /graphql. The ACSC's mitigation advice also points to reviewing the vendor support page for platform-specific guidance.

Step 4: Hunt for exploitation indicators

The ACSC lists signals worth reviewing: unusual system activity, unexpected scheduled tasks, and suspicious log entries such as unusual template processing or failed notifications. These are the kinds of artefacts a template-injection exploit can leave behind, and they are worth a targeted log review rather than a general scan.

Step 5: Confirm third-party coverage

Many commerce platforms are run by managed service providers or enterprise IT partners. The ACSC advises contacting that provider to confirm the products have been patched and are being monitored for suspicious activity. A contract that promises patching is not the same as evidence that patching happened.

Mechanism and impact recap

The underlying flaw is template-engine injection: unneutralised input is evaluated as template syntax instead of treated as data. The consequence of successful exploitation is code execution on the commerce server, with access to customer and order data, persistence, and onward movement into connected systems.

Exposure context

A ZoomEye query for app="Magento" returned 132,318 matching assets at the time of writing. This measures product-fingerprint prevalence, not confirmed vulnerability, and should not be presented as an exploitability count.

References

Top comments (0)