NPM · SEPTEMBER 2026 · CONFIRMED

Adobe Commerce Critical Vulnerability CVE-2026-75650: What You Need to Know

Severity
CRITICAL
CVSS
10
Affected component
adobe commerce (npm)
Affected versions
>= 2.4.4-NA, <= 2.4.4-NA or >= 2.4.4-p1, <= 2.4.4-p1 or >= 2.4.4-p10, <= 2.4.4-p10 or >= 2.4.4-p11, <= 2.4.4-p11 or >= 2.4.4-p12, <= 2.4.4-p12 or >= 2.4.4-p13, <= 2.4.4-p13 or >= 2.4.4-p2, <= 2.4.4-p2 or >= 2.4.4-p3, <= 2.4.4-p3 or >= 2.4.4-p4, <= 2.4.4-p4 or >= 2.4.4-p5, <= 2.4.4-p5 or >= 2.4.4-p6, <= 2.4.4-p6 or >= 2.4.4-p7, <= 2.4.4-p7 or >= 2.4.4-p8, <= 2.4.4-p8 or >= 2.4.4-p9, <= 2.4.4-p9 or >= 2.4.5-NA, <= 2.4.5-NA or >= 2.4.5-p1, <= 2.4.5-p1 or >= 2.4.5-p10, <= 2.4.5-p10 or >= 2.4.5-p11, <= 2.4.5-p11 or >= 2.4.5-p12, <= 2.4.5-p12 or >= 2.4.5-p13, <= 2.4.5-p13 or >= 2.4.5-p14, <= 2.4.5-p14 or >= 2.4.5-p2, <= 2.4.5-p2 or >= 2.4.5-p3, <= 2.4.5-p3 or >= 2.4.5-p4, <= 2.4.5-p4 or >= 2.4.5-p5, <= 2.4.5-p5 or >= 2.4.5-p6, <= 2.4.5-p6 or >= 2.4.5-p7, <= 2.4.5-p7 or >= 2.4.5-p8, <= 2.4.5-p8 or >= 2.4.5-p9, <= 2.4.5-p9 or >= 2.4.6-NA, <= 2.4.6-NA or >= 2.4.6-p1, <= 2.4.6-p1 or >= 2.4.6-p10, <= 2.4.6-p10 or >= 2.4.6-p11, <= 2.4.6-p11 or >= 2.4.6-p12, <= 2.4.6-p12 or >= 2.4.6-p13, <= 2.4.6-p13 or >= 2.4.6-p2, <= 2.4.6-p2 or >= 2.4.6-p3, <= 2.4.6-p3 or >= 2.4.6-p4, <= 2.4.6-p4 or >= 2.4.6-p5, <= 2.4.6-p5 or >= 2.4.6-p6, <= 2.4.6-p6 or >= 2.4.6-p7, <= 2.4.6-p7 or >= 2.4.6-p8, <= 2.4.6-p8 or >= 2.4.6-p9, <= 2.4.6-p9 or >= 2.4.7-NA, <= 2.4.7-NA or >= 2.4.7-b1, <= 2.4.7-b1 or >= 2.4.7-b2, <= 2.4.7-b2 or >= 2.4.7-beta3, <= 2.4.7-beta3 or >= 2.4.7-p3, <= 2.4.7-p3 or >= 2.4.7-p4, <= 2.4.7-p4 or >= 2.4.7-p5, <= 2.4.7-p5 or >= 2.4.7-p6, <= 2.4.7-p6 or >= 2.4.7-p7, <= 2.4.7-p7 or >= 2.4.7-p8, <= 2.4.7-p8 or >= 2.4.8-NA, <= 2.4.8-NA or >= 2.4.8-beta1, <= 2.4.8-beta1 or >= 2.4.8-beta2, <= 2.4.8-beta2 or >= 2.4.8-p1, <= 2.4.8-p1 or >= 2.4.8-p2, <= 2.4.8-p2 or >= 2.4.8-p3, <= 2.4.8-p3 or >= 2.4.9-alpha1, <= 2.4.9-alpha1 or >= 2.4.9-alpha2, <= 2.4.9-alpha2 or >= 2.4.9-alpha3, <= 2.4.9-alpha3 or >= 2.4.9-beta1, <= 2.4.9-beta1 or >= 2.2.0-RC1.3, <= 2.2.0-RC1.3 or >= 2.2.0-RC1.2, <= 2.2.0-RC1.2 or >= 2.2.0-RC1.1, <= 2.2.0-RC1.1 or >= 2.1.0, <= 2.1.0 or >= 2.1.0-rc3, <= 2.1.0-rc3 or >= 2.1.0-rc2, <= 2.1.0-rc2 or >= 2.1.0-rc1, <= 2.1.0-rc1 or >= 2.0.0, <= 2.0.0 or >= 2.0.0-rc, <= 2.0.0-rc or >= 0.74.0-beta1, <= 0.74.0-beta1 or >= 0.42.0-beta3, <= 0.42.0-beta3 or >= 0.1.0-alpha108, <= 0.1.0-alpha108 or >= 0.42.0-beta1, <= 0.42.0-beta1 or >= 0.1.0-alpha107, <= 0.1.0-alpha107 or >= 0.1.0-alpha106, <= 0.1.0-alpha106 or >= 0.1.0-alpha105, <= 0.1.0-alpha105 or >= 0.1.0-alpha104, <= 0.1.0-alpha104 or >= 0.1.0-alpha103, <= 0.1.0-alpha103 or >= 0.1.0-alpha102, <= 0.1.0-alpha102 or >= 0.1.0-alpha101, <= 0.1.0-alpha101 or >= 0.1.0-alpha100, <= 0.1.0-alpha100 or >= 0.1.0-alpha99, <= 0.1.0-alpha99 or >= 0.1.0-alpha98, <= 0.1.0-alpha98 or >= 0.1.0-alpha97, <= 0.1.0-alpha97 or >= 0.1.0-alpha96, <= 0.1.0-alpha96 or >= 0.1.0-alpha95, <= 0.1.0-alpha95 or >= 0.1.0-alpha94, <= 0.1.0-alpha94 or >= 0.1.0-alpha93, <= 0.1.0-alpha93 or >= 0.1.0-alpha92, <= 0.1.0-alpha92 or >= 0.1.0-alpha91, <= 0.1.0-alpha91 or >= 0.1.0-alpha90, <= 0.1.0-alpha90 or >= 0.1.0-alpha89, <= 0.1.0-alpha89
Patched version
Not yet available
CVE-2026-75650

Adobe Commerce has a critical vulnerability tracked as CVE-2026-75650. This vulnerability could allow an attacker to execute arbitrary code in the context of the current user.

What happened

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. This vulnerability could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.

The vulnerability affects multiple versions of Adobe Commerce, as detailed in the affected components section. It is recommended to upgrade to the latest version of Adobe Commerce and review any custom templates for potential vulnerabilities.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If adobe commerce is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Adobe Commerce version >= 2.4.4-NA, <= 2.4.4-NA or >= 2.4.4-p1, <= 2.4.4-p1 or >= 2.4.4-p10, <= 2.4.4-p10 or >= 2.4.4-p11, <= 2.4.4-p11 or >= 2.4.4-p12, <= 2.4.4-p12 or >= 2.4.4-p13, <= 2.4.4-p13 or >= 2.4.4-p2, <= 2.4.4-p2 or >= 2.4.4-p3, <= 2.4.4-p3 or >= 2.4.4-p4, <= 2.4.4-p4 or >= 2.4.4-p5, <= 2.4.4-p5 or >= 2.4.4-p6, <= 2.4.4-p6 or >= 2.4.4-p7, <= 2.4.4-p7 or >= 2.4.4-p8, <= 2.4.4-p8 or >= 2.4.4-p9, <= 2.4.4-p9 or >= 2.4.5-NA, <= 2.4.5-NA or >= 2.4.5-p1, <= 2.4.5-p1 or >= 2.4.5-p10, <= 2.4.5-p10 or >= 2.4.5-p11, <= 2.4.5-p11 or >= 2.4.5-p12, <= 2.4.5-p12 or >= 2.4.5-p13, <= 2.4.5-p13 or >= 2.4.5-p14, <= 2.4.5-p14 or >= 2.4.5-p2, <= 2.4.5-p2 or >= 2.4.5-p3, <= 2.4.5-p3 or >= 2.4.5-p4, <= 2.4.5-p4 or >= 2.4.5-p5, <= 2.4.5-p5 or >= 2.4.5-p6, <= 2.4.5-p6 or >= 2.4.5-p7, <= 2.4.5-p7 or >= 2.4.5-p8, <= 2.4.5-p8 or >= 2.4.5-p9, <= 2.4.5-p9 or >= 2.4.6-NA, <= 2.4.6-NA or >= 2.4.6-p1, <= 2.4.6-p1 or >= 2.4.6-p10, <= 2.4.6-p10 or >= 2.4.6-p11, <= 2.4.6-p11 or >= 2.4.6-p12, <= 2.4.6-p12 or >= 2.4.6-p13, <= 2.4.6-p13 or >= 2.4.6-p2, <= 2.4.6-p2 or >= 2.4.6-p3, <= 2.4.6-p3 or >= 2.4.6-p4, <= 2.4.6-p4 or >= 2.4.6-p5, <= 2.4.6-p5 or >= 2.4.6-p6, <= 2.4.6-p6 or >= 2.4.6-p7, <= 2.4.6-p7 or >= 2.4.6-p8, <= 2.4.6-p8 or >= 2.4.6-p9, <= 2.4.6-p9 or >= 2.4.7-NA, <= 2.4.7-NA or >= 2.4.7-b1, <= 2.4.7-b1 or >= 2.4.7-b2, <= 2.4.7-b2 or >= 2.4.7-beta3, <= 2.4.7-beta3 or >= 2.4.7-p3, <= 2.4.7-p3 or >= 2.4.7-p4, <= 2.4.7-p4 or >= 2.4.7-p5, <= 2.4.7-p5 or >= 2.4.7-p6, <= 2.4.7-p6 or >= 2.4.7-p7, <= 2.4.7-p7 or >= 2.4.7-p8, <= 2.4.7-p8 or >= 2.4.8-NA, <= 2.4.8-NA or >= 2.4.8-beta1, <= 2.4.8-beta1 or >= 2.4.8-beta2, <= 2.4.8-beta2 or >= 2.4.8-p1, <= 2.4.8-p1 or >= 2.4.8-p2, <= 2.4.8-p2 or >= 2.4.8-p3, <= 2.4.8-p3 or >= 2.4.9-alpha1, <= 2.4.9-alpha1 or >= 2.4.9-alpha2, <= 2.4.9-alpha2 or >= 2.4.9-alpha3, <= 2.4.9-alpha3 or >= 2.4.9-beta1, <= 2.4.9-beta1 or >= 2.2.0-RC1.3, <= 2.2.0-RC1.3 or >= 2.2.0-RC1.2, <= 2.2.0-RC1.2 or >= 2.2.0-RC1.1, <= 2.2.0-RC1.1 or >= 2.1.0, <= 2.1.0 or >= 2.1.0-rc3, <= 2.1.0-rc3 or >= 2.1.0-rc2, <= 2.1.0-rc2 or >= 2.1.0-rc1, <= 2.1.0-rc1 or >= 2.0.0, <= 2.0.0 or >= 2.0.0-rc, <= 2.0.0-rc or >= 0.74.0-beta1, <= 0.74.0-beta1 or >= 0.42.0-beta3, <= 0.42.0-beta3 or >= 0.1.0-alpha108, <= 0.1.0-alpha108 or >= 0.42.0-beta1, <= 0.42.0-beta1 or >= 0.1.0-alpha107, <= 0.1.0-alpha107 or >= 0.1.0-alpha106, <= 0.1.0-alpha106 or >= 0.1.0-alpha105, <= 0.1.0-alpha105 or >= 0.1.0-alpha104, <= 0.1.0-alpha104 or >= 0.1.0-alpha103, <= 0.1.0-alpha103 or >= 0.1.0-alpha102, <= 0.1.0-alpha102 or >= 0.1.0-alpha101, <= 0.1.0-alpha101 or >= 0.1.0-alpha100, <= 0.1.0-alpha100 or >= 0.1.0-alpha99, <= 0.1.0-alpha99 or >= 0.1.0-alpha98, <= 0.1.0-alpha98 or >= 0.1.0-alpha97, <= 0.1.0-alpha97 or >= 0.1.0-alpha96, <= 0.1.0-alpha96 or >= 0.1.0-alpha95, <= 0.1.0-alpha95 or >= 0.1.0-alpha94, <= 0.1.0-alpha94 or >= 0.1.0-alpha93, <= 0.1.0-alpha93 or >= 0.1.0-alpha92, <= 0.1.0-alpha92 or >= 0.1.0-alpha91, <= 0.1.0-alpha91 or >= 0.1.0-alpha90, <= 0.1.0-alpha90 or >= 0.1.0-alpha89, <= 0.1.0-alpha89.

What should I do right now?

Upgrade to the latest version of Adobe Commerce and review any custom templates for potential vulnerabilities.

Has this been exploited in the wild?

No, this vulnerability has not been exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats