Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day
Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.
Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).
- CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to RCE in Commerce/Magento.
- Attacks dubbed StyleSmuggler began September 4, triggering injected code via the Payment Transaction Failed Reminder email.
- Multiple actors deployed backdoors and web shells; Sansec urges rotating encryption keys and all source credentials.
- Adobe also fixed Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws.
- Other updates cover Experience Manager (107), Acrobat Reader (32), Photoshop (8), Illustrator and Animate.
- Malware
- StyleSmuggler
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-48273+1 related CVE | Eval Injection RCE in Adobe ColdFusion (CVSS 9.9, low-privileged attacker) | 9.9 group max | 2% | ||
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
| CVE-2026-82004 | Unauthenticated OS Command Injection in Adobe Campaign Classic | 10.0 | 1% |
From the original article
2 min read at securityweek.com
Tracked as CVE-2026-75650, the exploited defect allows unauthenticated attackers to execute arbitrary code. The post Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.