CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Record
CVE-2026-75650- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2026-72530
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Record
EUVD-2026-72530- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fj37-xm58-mf28
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template...
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Record
GHSA-fj37-xm58-mf28- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
CISA KEV No score
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
- Record
CVE-2026-75650- Weakness
- CWE-1336
- Updated
- 2026-11-02
NVD
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Record
CVE-2026-75650- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Record
CVE-2026-75650- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVROOT-APP-COMPOSER-CVE-2026-75650 No score
CVE-2026-75650 in magento/product-enterprise-edition - Patched by Root
Root has patched CVE-2026-75650 in the magento/product-enterprise-edition package for Root:Composer. Multiple fixed versions available.
- Record
ROOT-APP-COMPOSER-CVE-2026-75650- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/product-enterprise-editionRoot:Composer |
before 2.4.7-p1012007003+root.io | 2.4.7-p1012007003+root.io2.4.8-p512007003+root.io2.4.8-p512007004+root.io2.4.7-p1012007004+root.io2.4.8-p512007005+root.io2.4.7-p1012007005+root.io2.4.7-p1012007006+root.io2.4.8-p512007006+root.io |
magento/product-community-editionRoot:Composer |
before 0.74.0-beta2-p12007003+root.io | 0.74.0-beta2-p12007003+root.io2.3.1-p12007003+root.io2.4.7-p1012007003+root.io2.4.8-p512007003+root.io0.74.0-beta2-p12007004+root.io2.4.7-p1012007004+root.io2.3.1-p12007004+root.io2.4.8-p512007004+root.io2.3.1-p12007005+root.io2.4.7-p1012007005+root.io0.74.0-beta2-p12007005+root.io2.4.8-p512007005+root.io |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | jithinkrishnanrs/stylesmuggler-ioc-toolkit | 2026-09-07 |
| PoC in GitHub | dinosn/cve-2026-75650-magento-validation-lab | 2026-09-08 |
| PoC in GitHub | disrex-group/stylesmuggler-adobe-patches | 2026-09-08 |
| PoC in GitHub | disrex-group/stylesmuggler-adobe-patches-mageos | 2026-09-08 |
| PoC in GitHub | fortbridge/stylesmuggler | 2026-09-12 |
| PoC in GitHub | abraxas/CVE-2026-75650 | 2026-09-26 |
| PoC in GitHub | basesixtythree/B63-POC-CVE-2026-75650 | 2026-10-26 |
| Nuclei | Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits | Nuclei | |
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75650 is a critical vulnerability (CVSS 10.0) in Adobe Commerce, published September 7, 2026. CISA lists it as known to be exploited, since September 8, 2026. EUVD reports exploitation since September 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.95%, the 90th percentile. Fixed in magento/product-enterprise-edition 2.4.7-p1012007003+root.io.