# CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

- Exploited (CISA KEV): yes, added 2026-09-08
- Published: 2026-09-07
- CVSS: 10 CRITICAL (v3.1)
- EPSS: 3.9% (90th percentile)
- CWE: CWE-1336

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2026-09-10 | 3 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-09-10 · new · rule f9a3026b0fdc4d63b7338346440f5c55 · default Block
  > Adobe Commerce - Remote Code Execution - CVE:CVE-2026-75650. Previous action: N/A. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-09-10-emergency-waf-release/

## Social

1 posts seen since 2026-11-02.

- x 2026-11-02: CVE-2026-75650 (StyleSmuggler) is a shared access vector: a likely Chinese-speaking operator used it to deploy PSK Agent RAT, a DNS beacon, and a PHP webshell against Magento stores across Western Europe, North America, and Asia-Pacific between September 9-13, 2026.  Key https:/… (https://x.com/DFIR_Radar/status/2117361621408645384)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-75650 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-75650