Remote arbitrary code execution affecting Adobe Commerce
A critical vulnerability affecting Adobe Commerce would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems. This vulnerability is the subject of proven exploitation.
Description
Technical context and vulnerability details
Adobe Commerce is a flexible e-commerce platform used by businesses to create and manage online stores. It integrates catalog management, order processing and online payment functionalities. This product is affected by a vulnerability labeled CVE-2026-75650 which results from incorrect neutralization of special elements used in a template engine. Exploitation of this vulnerability would allow an unauthenticated malicious actor to remotely execute arbitrary code in the context of the current user. It is classified critical with a severity score of 10.0 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Data privacy breach;
- Compromise of system integrity;
- System availability compromised;
Affected systems
Products, components and targeted versions
- The versions of Adobe Commerce affected are those specified by the publisher in its security advisory;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Adobe Commerce to patched or later versions;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.