CVE-2026-75650: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) in Adobe Adobe Commerce

CVE-2026-75650 is a critical vulnerability in Adobe Commerce caused by improper neutralization of special elements used in its template engine (CWE-1336). This vulnerability enables remote code execution (RCE) without requiring user interaction, allowing an attacker to execute arbitrary code in the context of the current user. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. The affected version is listed as =0, which likely indicates incomplete version data. No official patch or mitigation information is currently available.

Successful exploitation results in arbitrary code execution with full impact on confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without user interaction, increasing the risk of widespread compromise. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Organizations should monitor Adobe's security advisories for updates and apply patches promptly once released.