DEV Community

StarkMan
StarkMan

Posted on

Patching Guide for CVE-2026-75650: Closing the Adobe Commerce RCE

#security #vulnerability #adobe #magento

Patching Guide for CVE-2026-75650: Closing the Adobe Commerce RCE

CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CERT-In's CIVN-2026-0458 rates the advisory CRITICAL and notes that Adobe has confirmed in-the-wild exploitation. This guide focuses on the practical work: identifying affected deployments, applying the fix and confirming it landed.

What you are fixing

The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on a vulnerable server. It affects the commerce platform line rather than the desktop or document products that share the same advisory. The relevant vendor bulletins are apsb26-138 and apsb26-146.

Step 1: Build an accurate inventory

Before patching, enumerate every deployment. Include:

  • Production storefronts and their API endpoints.
  • Staging, QA and preview environments, which are frequently internet-reachable and rarely patched on the same schedule.
  • Adobe Commerce B2B installations, which are covered by separate version ranges.
  • Magento Open Source instances, including those maintained by third-party agencies. The affected version ranges from CERT-In are:
  • Adobe Commerce 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier, 2.4.5-2026-aug and earlier, 2.4.4-2026-aug and earlier.
  • Adobe Commerce B2B 1.5.3-2026-aug and earlier, 1.5.2-2026-aug and earlier, 1.4.2-2026-aug and earlier, 1.3.4-2026-aug and earlier, 1.3.3-2026-aug and earlier.
  • Magento Open Source 2.4.9-2026-aug and earlier, 2.4.8-2026-aug and earlier, 2.4.7-2026-aug and earlier, 2.4.6-2026-aug and earlier.

Step 2: Apply the vendor update

Follow Adobe's guidance in apsb26-138 and apsb26-146. Standard practice for this platform applies: take a verified backup, apply the update in a non-production environment first, and keep the deployment tooling consistent so the patch is reproducible.

Step 3: Verify the deployed version

A patch ticket is not evidence that the running code changed. After deployment, read the version from the application itself and confirm it falls outside the affected ranges. Check every node behind the load balancer, not just the first one.

Step 4: Reduce exposure while patching

If the update cannot be applied immediately, narrow the attack surface. Restrict network access to the application and to administrative and API paths, and place the storefront behind controls that can block anomalous requests. These are compensating measures, not substitutes for the vendor fix.

Step 5: Assume compromise on internet-facing hosts

Because Adobe has confirmed active exploitation, an internet-facing commerce host that ran an affected version should be treated as potentially compromised even after patching. The patch closes the door; it does not remove an attacker who already walked through it. Review administrative accounts for additions, inspect templates and files for modification, and examine outbound connections for command-and-control or exfiltration traffic.

Exposure note

A ZoomEye query for app="Magento" returned 132,158 assets, describing the reachable population of the product family. A query for the CVE identifier returned zero, which is normal for a newly published CVE and does not indicate low exposure.

References

Top comments (0)