Our automated tracking framework flagged that CISA added CVE-2026-75650 (Adobe Commerce and Magento) to the Known Exploited Vulnerabilities (KEV) catalog on September 9, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-75650 by September 11, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-75650 |
| Vendor / product | Adobe Commerce and Magento |
| Vulnerability | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability |
| CVSS base score | 10 |
| Added to KEV | September 8, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | September 11, 2026 |
| Known ransomware use | No |
How This Compares to Adobe’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than Adobe’s 2627-day median, meaning attackers moved unusually quickly. Adobe currently ranks #3 on our KEV Lag leaderboard.
| Adobe in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 81 |
| Median lag (public → KEV listing) | 2627 days |
| 0-day rate (exploited at or before disclosure) | 4% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1699 tracked KEV entries is 260 days — Adobe’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Adobe KEV Additions
The most recent Adobe vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-48282 | ColdFusion | July 7, 2026 | 7 | No |
| CVE-2009-3459 | Acrobat and Reader | May 20, 2026 | 6063 | No |
| CVE-2020-9715 | Acrobat | April 13, 2026 | 2063 | No |
| CVE-2026-34621 | Acrobat and Reader | April 13, 2026 | 2 | No |
| CVE-2025-54236 | Commerce and Magento | October 24, 2025 | 45 | No |
What This Means for Defenders
CISA has added CVE-2026-75650, an Improper Neutralization of Special Elements vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities (KEV) catalog. With a critical CVSS base score of 10, this vulnerability demands immediate attention from all organizations using these platforms. Federal agencies face a mandatory patching deadline of September 11, 2026, just three days after its KEV listing on September 8, 2026. This rapid inclusion makes prompt action important for all sectors.
The 1-day lag between the vulnerability’s public disclosure and its KEV listing means attackers were quick to weaponize this flaw. While known ransomware use hasn’t been confirmed, the high CVSS score and observed exploitation make it a target for various threat actors. This rapid inclusion is highly unusual.
Patch Adobe Commerce and Magento installations before September 11, 2026. If you cannot, restrict network access to affected systems and enhance monitoring for suspicious activity. Prioritizing this patch is essential to prevent compromise, given the active exploitation and critical nature of the vulnerability.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
