Adobe security advisory (AV26-888)
Canada's Cyber Centre warns CVE-2026-75650 in Adobe Commerce and Magento Open Source is exploited in the wild; hotfixes and updates are available.
Canadian Centre for Cyber Security advisory AV26-888 (September 8, 2026) covers CVE-2026-75650 in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe states the vulnerability is being exploited in the wild. Affected versions extend through the August 2026 patch levels across the 2.4.4-2.4.9 branches, with B2B versions 1.3.x-1.5.x also affected. Administrators are urged to apply the available hotfixes and updates.
- CVE-2026-75650 is exploited in the wild according to Adobe
- Affects Adobe Commerce, Adobe Commerce B2B and Magento Open Source prior to August 2026 hotfix levels
- CCC advisory AV26-888 urges users and administrators to apply available updates
- Vendors
- Adobe
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-7565 | The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and… | 4.9 | <1% | ||
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-888 Date: September 8, 2026 As of September 7, 2026, Adobe is affected by a vulnerability in the following products: Adobe Commerce All except Hotfix for CVE-2026-7565 Prior to or equal to 2. 4. 9-2026-aug, 2.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.