Project
Open-source PHP e-commerce platform, first released in 2008 and now maintained by Adobe as the free edition of Magento.
Sansec reproduced an unauthenticated code-execution chain on clean 2.4.7, 2.4.8 and 2.4.9 installs, and the first victim it saw was already on Adobe's newest patch level for its release line.
Perspective Coverage
7 publishersReality
Magento Open Source stopped patching 2.4.6 on 11 August 2026, and about seven of the paid edition's twelve extra months fall after PHP 8.2 stops getting security fixes. The licence buys planning time.
Reality
CERT-In's September 16 advisory covers eleven Adobe product lines and fourteen vulnerability classes. Adobe says one of them, an unauthenticated remote code execution flaw in the commerce line, is already being exploited.
Reality
Adobe scored CVE-2026-75650 at 10.0 and shipped hotfix VULN-39341 three days after Sansec first saw it exploited. The first confirmed victim was running 2.4.6-p15, the newest release, and it had passed a security status check.
Reality
Adobe scored CVE-2026-75650 at 10.0 and hotfixed it outside the normal cycle after exploitation had already started. Imperva reports attempts against sites in 15 countries and backdoors dressed as system processes.
Reality
Sansec says the injected code executes while the server builds the notification, so nobody has to open anything and delivery can fail outright. Adobe's hotfix shuts the door and leaves the Rust backdoor and exposed credentials in place.
Reality
Adobe shipped the out-of-band hotfix on September 8. Sansec dates exploitation to September 4, and that four-day gap is why the advisory pairs the patch with a required encryption-key rotation.
Reality
CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.
Reality