{"basis":"claimed","id":"CVE-2026-75650","name":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","vendorProject":"Adobe","product":"Commerce and Magento","publishedAt":"2026-09-07","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2026-09-08","dueDate":"2026-09-11","ransomware":false},"epss":{"score":0.03949,"percentile":0.90416,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2026-09-10","daysToRule":3},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)","description":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cwes":["CWE-1336"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2026-09-10","firstIsNew":true,"daysToRule":3,"daysAtMost":null,"freePlan":false,"claims":[{"id":"df1725299a3a0aeaa2337b791d5f4baf84e4a181403894a1c090e2ed0dc6fb03","cve_id":"CVE-2026-75650","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"f9a3026b0fdc4d63b7338346440f5c55","rule_name":"Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650","change":"new","default_action":"Block","published_on":"2026-09-10","source_url":"https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/","source_title":"WAF Release - 2026-09-10 - Emergency","excerpt":"Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650. Previous action: N/A. New action: Block. This is a new detection.","first_seen_at":"2026-11-02T21:00:15.176Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T01:17:37.773Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[],"social":{"total":1,"first_seen":"2026-11-02T21:02:03.000Z","daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":1},{"day":"2026-11-03","posts":0}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/DFIR_Radar/status/2117361621408645384","author":"DFIR_Radar","author_name":"DFIR Radar","avatar_url":"https://pbs.twimg.com/profile_images/2033689817951682561/1fQAvsug_bigger.jpg","text":"CVE-2026-75650 (StyleSmuggler) is a shared access vector: a likely Chinese-speaking operator used it to deploy PSK Agent RAT, a DNS beacon, and a PHP webshell against Magento stores across Western Europe, North America, and Asia-Pacific between September 9-13, 2026.\n\nKey https:/…","engagement":0,"posted_at":"2026-11-02T21:02:03.000Z"}],"exploit_repositories":[]}}