# Adobe Commerce zero-day exploited in the wild

Published: 2026-09-08 · Severity: severe · Sectors: retail, technology
Canonical: https://vorant.io/reports/cc39072b-a63e-532b-adcc-38646763ff40/adobe-commerce-zero-day-exploited-in-the-wild

> NCSC-NL warns of an actively exploited critical template injection flaw in Adobe Commerce and Magento allowing unauthenticated remote code execution.

NCSC-NL issued a high-priority advisory (NCSC-2026-0344) for CVE-2026-75650, a critical improper neutralization vulnerability in the template engine of Adobe Commerce and Magento. The flaw allows an attacker to execute arbitrary code remotely without any user interaction, by abusing a modified scope to escalate privileges or alter the execution context. The vulnerability carries a maximum CVSS v3 score of 10.0.

Adobe has confirmed this vulnerability is already being actively exploited in the wild, making immediate patching a priority for all organizations running affected Adobe Commerce or Magento installations. Adobe has released updates to address the issue; defenders should apply these patches immediately and review Adobe's official references for affected version details and further remediation guidance. Given the unauthenticated, zero-click RCE nature of this flaw combined with confirmed active exploitation, this represents a severe risk to any internet-facing e-commerce platform running the affected software.

## Mentioned in this report

- Vulnerabilities: CVE-2026-75650 (KEV)

## Detection guidance (public sample)

### Adobe Commerce Template Engine Arbitrary Code Execution

ATT&CK: T1190

Detects POST requests to Adobe Commerce endpoints with template injection payloads in query parameters or request body, exploiting CVE-2026-75650. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Commerce Template Engine Arbitrary Code Execution
description: Detects exploitation attempts against CVE-2026-75650 in Adobe Commerce/Magento
  - improper neutralization in template engine allowing RCE. Matches POST requests
  to typical Commerce paths with suspicious template syntax in parameters.
tags:
- attack.t1190
logsource:
  category: proxy
  product: web
detection:
  selection_post:
    http_method: POST
  selection_commerce_path:
    url|contains:
    - /index.php/admin
    - /index.php/customer
    - /graphql
    - /rest/
  selection_template_payload:
    url|contains|all:
    - '{{'
    - '}}'
  selection_or_body:
    http_request_body|contains:
    - expression{{
    - '{{7*7}}'
    - scope{{
  condition: selection_post and selection_commerce_path and (selection_template_payload
    or selection_or_body)
falsepositives:
- Legitimate GraphQL queries with curly braces in Commerce API calls
- Administrative template management operations
level: high
id: e4cefebc-b956-5b91-9170-e7e8ec54e273
status: experimental
author: Vorant
```

### Suspicious Web Process Spawning from PHP/Apache

ATT&CK: T1055

Detects PHP or Apache web server processes spawning cmd.exe, powershell.exe, or bash with unusual parent/child relations indicating post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Web Process Spawning from PHP/Apache
description: Detects web server processes (php.exe, httpd.exe, apache.exe) spawning
  shell or command execution processes - typical RCE post-exploitation after template
  injection in e-commerce platforms.
tags:
- attack.t1055
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php.exe
    - \httpd.exe
    - \apache.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash.exe
  filter_legitimate:
    CommandLine|contains:
    - php -S
    - --version
  condition: selection_parent and selection_child and not filter_legitimate
falsepositives:
- Legitimate PHP development servers spawning shells for testing
- Web server diagnostic tools invoking system commands
level: high
id: 5e528880-123e-5dd9-82e1-789c4a7aa23e
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0344.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cc39072b-a63e-532b-adcc-38646763ff40/adobe-commerce-zero-day-exploited-in-the-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup