Adobe Commerce APSB26-146: Everything You Need to Know About the CVE-2026-75650 Zero-Day (and How to Fix It Today)

If you run an Adobe Commerce or Magento Open Source store, stop what you're doing and read this. On September 7, 2026, Adobe released Security Bulletin APSB26-146, disclosing a critical, actively exploited zero-day vulnerability — tracked as CVE-2026-75650 — that lets an unauthenticated attacker execute arbitrary code on affected stores. Adobe has confirmed this vulnerability is already being exploited in the wild against Adobe Commerce merchants.

This guide breaks down what happened, who's affected, and exactly how to patch and secure your store, step by step.

Quick Answer (TL;DR)

• What it is: A zero-day remote code execution (RCE) vulnerability in Adobe Commerce and Magento Open Source, identified as CVE-2026-75650.
• Severity: Critical — exploitable by an unauthenticated attacker, meaning no login or account access is required.
• Status: Actively exploited in the wild as of the September 7, 2026 disclosure.
• Fix: Apply the VULN-39341 composer patch immediately, then rotate your encryption keys and all associated credentials.
• Who must act: Anyone running Adobe Commerce (Cloud or on-premises), Adobe Commerce B2B, or Magento Open Source on the versions listed below.

What Is APSB26-146?

APSB26-146 is the official Adobe Security Bulletin published to address CVE-2026-75650, a zero-day vulnerability discovered in Adobe Commerce. According to Adobe's advisory, the flaw could allow an unauthenticated attacker to execute arbitrary code on an affected installation — one of the most severe classes of vulnerability an ecommerce platform can face, since it doesn't require stolen credentials or insider access to exploit.

Because Adobe confirmed active exploitation before or at the time of disclosure, this is being treated as an emergency patch rather than a routine update cycle.

Who Is Affected?

The vulnerability impacts a wide range of currently supported and legacy versions across three product lines.

Adobe Commerce (all affected versions and earlier)

• 2.4.9-2026-aug and earlier
• 2.4.8-2026-aug and earlier
• 2.4.7-2026-aug and earlier
• 2.4.6-2026-aug and earlier
• 2.4.5-2026-aug and earlier
• 2.4.4-2026-aug and earlier

Adobe Commerce B2B (all affected versions and earlier)

• 1.5.3-2026-aug and earlier
• 1.5.2-2026-aug and earlier
• 1.4.2-2026-aug and earlier
• 1.3.4-2026-aug and earlier
• 1.3.3-2026-aug and earlier

Magento Open Source (all affected versions and earlier)

• 2.4.9-2026-aug and earlier
• 2.4.8-2026-aug and earlier
• 2.4.7-2026-aug and earlier
• 2.4.6-2026-aug and earlier

This applies to Adobe Commerce on Cloud (Adobe-managed infrastructure), Adobe Commerce on-premises, and self-hosted Magento Open Source deployments alike. If you haven't confirmed your exact build version, treat your store as at-risk until verified.

How to Fix It: Step-by-Step Patch Instructions

Step 1: Download and Apply the VULN-39341 Hotfix

Adobe has released a composer patch, VULN-39341, that resolves the vulnerability for all affected product versions. Download VULN-39341-composer-patches.zip from Adobe's official patch repository and unzip it, then apply it using one of the methods below.

Before you start: Adobe strongly recommends applying and testing the patch on a staging/integration environment before touching production, and taking a recent backup before making any changes.

If you're on Adobe Commerce on Cloud infrastructure:

1. If your project root doesn't already have a directory named m2-hotfixes, create one.
2. Copy the .composer.patch file(s) from the unzipped hotfix into the m2-hotfixes directory.
3. Add, commit, and push the change so it deploys through your normal Cloud pipeline:

   git add -A
   git commit -m "Apply VULN-39341 composer patch"
   git push origin

If you're on Adobe Commerce on-premises or Magento Open Source:

1. Upload the patch file to your Adobe Commerce/Magento root directory (via SFTP, SSH, or your normal transport method).
2. Run the following SSH command from the root directory:

   patch -p1 < VULN-39341-composer-patches.patch

(If this doesn't work, try -p2 instead of -p1.) 3. Refresh the cache in the Admin under System > Cache Management so the change takes effect.

Alternative for either environment — the Quality Patches Tool: Adobe's Quality Patches Tool can apply and track official patches for you, and it's the same tool you'll use in Step 2 to confirm the patch applied. If it's already part of your workflow, you can install/update it via Composer and let it apply VULN-39341 directly, rather than patching manually.

Compatibility note: Adobe has officially tested this hotfix against the specific "2026-aug" version tags listed above. It may work on other supported versions, but this hasn't been officially verified by Adobe — test in a staging environment first wherever possible.

Step 2: Confirm the Hotfix Was Applied (Cloud Merchants)

Because this exploit leaves no obvious front-end symptoms, silently confirming the patch is critical — don't assume it worked.

1. Install the Quality Patches Tool if you don't already have it.
2. Run: vendor/bin/magento-patches -n status | grep "39341\|Status"
3. Confirm the patch status reads Applied (Category: Other, Origin: Local, Patch type: Custom).

Step 3: Rotate Every Credential the Encryption Key Could Have Exposed

This is the step teams most often skip — and it's arguably as important as the patch itself. The encryption key protects integration tokens, payment gateway credentials, and system-privileged automation tokens. Patching the vulnerability does not invalidate credentials that were already exposed. If an attacker had code execution before you patched, assume every secret on that server may be compromised.

Full remediation checklist:

1. Apply the VULN-39341 hotfix.
2. Enable maintenance mode.
3. Disable cron execution (vendor/bin/ece-tools cron:disable on Commerce on Cloud).
4. Rotate your Commerce encryption key.
5. Rotate all Admin panel user passwords.
6. Deactivate and regenerate all REST/SOAP/GraphQL integration tokens (System > Extensions > Integrations).
7. Rotate OAuth client secrets for any connected third-party apps.
8. Rotate payment gateway API credentials at the provider level — Stripe, Braintree, Adyen, PayPal, etc.
9. Rotate database credentials.
10. Rotate SSH/deploy keys and any cron or system-privileged service account credentials.
11. Rotate API keys for shipping, tax, and other third-party integrated extensions.
12. Flush the cache.
13. Re-enable cron execution (vendor/bin/ece-tools cron:enable).
14. Disable maintenance mode.
15. Commerce on Cloud only: Redeploy to apply the new database credentials.

Important: Rotating the encryption key inside Commerce does not, by itself, invalidate credentials at external services. You must separately rotate payment gateway and third-party API credentials at their source — not just within your Commerce admin.

Why This Matters More Than a Typical Patch Tuesday

Most Adobe Commerce security patches address vulnerabilities discovered through responsible disclosure or internal audits, before any real-world exploitation. APSB26-146 is different: Adobe has explicitly stated this CVE is being actively exploited against live merchant stores right now. An unauthenticated RCE vulnerability under active exploitation is about as urgent as ecommerce security incidents get — it can lead to full server compromise, data exfiltration (including customer payment data), malware injection, and persistent backdoors, often without any login attempt ever showing up in your access logs.

Frequently Asked Questions

Is my store affected if I'm on the latest 2.4.9 build?
Yes. Adobe lists 2.4.9-2026-aug and earlier as affected, meaning even merchants on recent builds need to apply the VULN-39341 patch.

Do I need to rotate credentials if I patch quickly?
Yes. Because the vulnerability may have already been exploited before you patch, Adobe recommends rotating your encryption key and all dependent credentials regardless of how fast you applied the fix.

Does this affect Magento Open Source, or only Adobe Commerce?
Both. Magento Open Source versions 2.4.6 through 2.4.9 (2026-aug builds and earlier) are affected alongside Adobe Commerce and Adobe Commerce B2B.

Where do I download the official patch?
Only download VULN-39341-composer-patches.zip from Adobe's official Magento patch repository, and cross-check the fix against the official Adobe Security Bulletin APSB26-146.

How do I know if the hotfix actually applied successfully?
Use the Quality Patches Tool and run vendor/bin/magento-patches -n status | grep "39341\|Status" — the patch should show a status of "Applied."

Official Sources

• Adobe Security Bulletin: APSB26-146 (helpx.adobe.com)
• Adobe Experience League Commerce Knowledge Base: Urgent Action Required — Critical Security Update Available for Adobe Commerce (APSB26-146)

Bottom Line

CVE-2026-75650 is a critical, actively exploited, unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source. If your store runs any affected version, apply the VULN-39341 patch immediately and treat credential rotation as mandatory, not optional. Waiting even a few days on a vulnerability that's already being exploited in the wild significantly raises your risk of a breach.