Topic
Adobe Commerce
CISA Adds Brotli and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
Vulnerabilities & Exploits
CISA Adds Adobe Commerce and WSO2 Vulnerabilities to Known Exploited Vulnerabilities Catalog
Vulnerabilities & ExploitsCritical Zero-Day 'StyleSmuggler' Vulnerability Exploited in Adobe Commerce and Magento
Vulnerabilities & ExploitsCritical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.
Adobe Issues 12 Security Advisories Addressing 89 Vulnerabilities Across Multiple Products
Adobe released 12 security advisories on July 14, 2026, addressing a total of 89 vulnerabilities in products including ColdFusion, Adobe Commerce, Experience Manager, Illustrator, and others. The updates align with Microsoft's Patch Tuesday schedule and cover critical flaws rated at the highest severity level. Several vulnerabilities in ColdFusion, Commerce, Experience Manager, and Illustrator received CVSS v3.1 base scores of 9.0 or higher. Adobe ColdFusion received the highest priority rating of 1, requiring remediation within 72 hours, while Adobe Commerce was assigned priority 2 with a 30-day update window. No active exploitation of the vulnerabilities had been observed at the time of disclosure. The advisories include dozens of specific CVE identifiers for each affected product line.