Develop Better SolutionsBlog

Severity: CriticalDisclosed PHP

Magento and Adobe Commerce zero-day used to take over shops: patch and rotate keys

An exploited Magento flaw let attackers run code on online shops without logging in. Adobe asks merchants to patch and rotate credentials.

Affects:Magento Open Source 2.4.6 to 2.4.9Adobe Commerce 2.4.4 to 2.4.9

In September 2026, Adobe published security bulletin APSB26-146, dated 7 September, with an emergency hotfix for Adobe Commerce and Magento Open Source. It fixes CVE-2026-75650, a template engine flaw rated 10.0 out of 10 that lets an attacker run code on the shop's server without logging in. Adobe said it was aware of the flaw being exploited in the wild, and its knowledge base calls it a zero-day targeting merchants. The US agency CISA added it to its catalog of exploited vulnerabilities on 8 September 2026.

A few weeks later, on 24 September, CISA also listed CVE-2026-71362, a Magento authorization flaw fixed in Adobe's August 2026 bulletin APSB26-92, as exploited. It can give an attacker elevated access to sensitive resources.

Who is affected

Magento Open Source 2.4.6 to 2.4.9 and Adobe Commerce 2.4.4 to 2.4.9, in all builds dated August 2026 and earlier, unless the hotfix for CVE-2026-75650 is applied. Adobe Commerce B2B is also listed. Your host does not usually patch Magento itself: this is the job of the shop owner or the agency that maintains the shop.

How to check your site

  • Log in to the Magento admin. The version is shown at the bottom of the admin pages.
  • Ask your developer or agency whether the hotfix for CVE-2026-75650 (Adobe patch reference VULN-39341) has been applied, and on what date.
  • Ask whether the August 2026 security update was installed too.

What to do now

  1. Have the hotfix for your exact version applied now, following Adobe's knowledge base article. Then update to Adobe's newest release.
  2. Adobe says patching alone is not enough. Its advice includes rotating the encryption key, all admin passwords, API and integration tokens, payment gateway credentials, database credentials and SSH or deploy keys.
  3. Ask your developer to look for unknown admin users and unexpected files on the server, and to review recent orders and payment settings.
  4. If you find signs of compromise, inform your payment provider and seek professional help, as card data may be involved.

Shops whose developer applied the hotfix and rotated credentials in September 2026 are most likely protected, but because attacks started before the fix, the checks above are still worth doing. This alert reports what the sources listed below published and is not a guarantee about any specific site.

Sources