Adobe is urging Adobe Commerce and Magento Open Source operators to take immediate action on CVE-2026-75650, a critical remote-code-execution vulnerability that the company says is being exploited in the wild. Adobe’s September 7 security bulletin assigns the issue a Priority 1 rating and says exploitation does not require authentication.

For merchants, this is not a routine patch-window item. Adobe says the vulnerability can let an unauthenticated attacker execute arbitrary code on an affected installation. Its Commerce knowledge-base guidance specifically says it has seen exploitation targeting Adobe Commerce merchants and directs administrators to apply the hotfix and rotate encryption keys as part of the response.

What Adobe has confirmed

Adobe identifies CVE-2026-75650 as an improper neutralization issue in a template engine. The security bulletin rates it Critical with a CVSS base score of 10.0 and lists arbitrary code execution as the impact. The bulletin also says that no credentials are required to exploit it.

The affected-product list includes Adobe Commerce versions 2.4.4 through 2.4.9 at the August 2026 release level and earlier, Adobe Commerce B2B versions 1.3.3 through 1.5.3 at their August 2026 release level and earlier, and Magento Open Source versions 2.4.4 through 2.4.9 at the August 2026 release level and earlier. Administrators should use Adobe’s bulletin and hotfix guidance to map their precise installed version to the applicable package; version labels alone are not enough to establish that a deployment is protected.

Adobe’s urgent guidance says the CVE-2026-75650 hotfix is available for current and earlier supported Commerce and Magento Open Source versions. It also provides version-specific packages and verification instructions. A deployment that has a September isolated patch should not assume that alone resolves this issue: Adobe’s published guidance calls out the CVE-specific hotfix in addition to its other September security-update material.

Why key rotation is part of remediation

Applying the hotfix closes the identified vulnerability, but Adobe’s response guidance goes further. It says merchants must rotate their encryption key and all credentials that may have been encrypted or exposed using it. The vendor notes that the Commerce encryption key protects, among other items, integration tokens, payment-gateway credentials and system-privileged automation tokens.

That distinction matters. Rotating a key inside Commerce does not invalidate a credential that may already have been copied. Adobe therefore directs customers to rotate associated credentials at their source, including relevant payment-provider and third-party-service credentials. Its documented sequence includes admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment-gateway credentials, database and CDN credentials, SSH or deployment keys, and integrated service API keys where applicable.

Recommended response sequence

  1. Identify affected storefronts and versions. Inventory Commerce, Commerce B2B and Magento Open Source deployments, including cloud and on-premises environments. Compare the exact installed version and patch state with Adobe’s APSB26-146 bulletin and hotfix matrix.
  2. Apply Adobe’s CVE-specific hotfix. Obtain the package matching the deployment from Adobe and follow the vendor’s installation instructions. For Commerce on Cloud, Adobe also documents a way to check that the hotfix reports as applied.
  3. Verify rather than assume. Use Adobe’s documented patch-status tooling or its stated verification path after deployment. Record the result per storefront and environment so an emergency change can be audited and repeated where necessary.
  4. Rotate the encryption key and associated secrets. Follow Adobe’s published sequence after applying the patch. Prioritize credentials used by payment gateways, integrations, administrators, deployment systems and privileged automation because the vendor explicitly identifies those categories as protected by or associated with the key.
  5. Investigate possible compromise. Treat an internet-facing affected deployment as an incident candidate until its exposure, patch status and relevant application, administrative and infrastructure logs have been reviewed. Escalate findings through the organization’s incident-response process instead of treating key rotation as proof that no access occurred.

Keep the response vendor-led

Adobe has published the hotfix details and the remediation sequence because applying mismatched packages or skipping associated credential rotation can leave an organization with an incomplete response. Teams should avoid copying generic commands or third-party exploit claims into production changes. The authoritative sources are Adobe’s APSB26-146 security bulletin and its urgent Commerce guidance, both of which are linked below.

For organizations that operate multiple storefronts, the practical challenge is coordination: owners of ecommerce operations, platform engineering, payments, identity and incident response need a single inventory and a single completion record. The security objective is not merely a successful patch command; it is to establish which systems were exposed, which hotfix was applied, which secrets were replaced and whether investigation found evidence requiring further containment.