Adobe has released an urgent security update for Adobe Commerce and Magento Open Source after confirming that attackers have exploited a critical vulnerability against merchants.
The vulnerability, CVE-2026-75650, can allow an attacker to execute code on an affected installation without logging in. Adobe published the fix on September 7 under APSB26-146, assigning it a critical severity rating, a CVSS score of 10.0, and Priority 1. See the Adobe security bulletin.
For store owners, the immediate job is to get your development team working on the response. That includes applying the hotfix, rotating encryption keys and potentially exposed credentials, and confirming that the work is complete in production.
Ask your team to confirm both patch deployment and credential rotation. Adobe requires both as part of its remediation instructions.
Which Adobe Commerce and Magento versions are affected?
Adobe lists the following affected product branches. In each branch, the advisory includes the -2026-aug release and earlier versions.
| Product | Version branches listed by Adobe | Affected releases within each listed branch |
|---|---|---|
| Adobe Commerce | 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4 | -2026-aug and earlier |
| Adobe Commerce B2B | 1.5.3, 1.5.2, 1.4.2, 1.3.4, 1.3.3 | -2026-aug and earlier |
| Magento Open Source | 2.4.9, 2.4.8, 2.4.7, 2.4.6 | -2026-aug and earlier |
The remediation guidance covers Adobe Commerce on cloud infrastructure, Adobe Commerce on-premises, and Magento Open Source. Check your exact installed versions against Adobe’s affected-version list, including the B2B package if your store uses it.
Adobe also distinguishes affected versions from tested hotfix compatibility. It says the hotfix was tested on the specific -2026-aug builds listed in its resolution section. If your store runs an earlier build, have your technical team confirm the application path for that version.
Apply the hotfix and verify it in production
Adobe’s fix is VULN-39341. Your team should obtain it through the official advisory and follow the patch instructions for your hosting setup.
Adobe recommends a recent backup and testing the patch in a staging or integration environment before production. The deployment method differs between Commerce on cloud infrastructure and on-premises or Magento Open Source installations. Use Adobe’s Composer patch instructions for the applicable procedure.
Treat this as an urgent deployment. Agree on an owner and a completion time with your team today.
After deployment, ask for confirmation that the hotfix was successfully applied to the production environment. For Commerce on cloud infrastructure, Adobe provides a specific verification method using the Quality Patches Tool in its hotfix verification instructions.
Rotate credentials at their source
Credential rotation needs its own owner and completion check.
Commerce uses an encryption key to protect sensitive information, including integration and payment credentials. If an attacker has already obtained a usable credential, changing the Commerce encryption key does not revoke that credential at the service that issued it.
For example, an exposed payment provider API key needs to be replaced at the payment provider. Changing the encryption key inside Commerce cannot do that for you.
Adobe’s required rotation procedure covers:
- Commerce access: encryption keys and all Admin user passwords.
- Integrations: deactivation and regeneration of REST, SOAP, and GraphQL integration tokens, plus rotation of OAuth client secrets for connected applications.
- Payments: payment gateway API credentials, rotated at the provider.
- Infrastructure: database credentials, SSH and deployment keys, and credentials used by cron jobs or privileged service accounts.
- Other connected services: API keys for shipping, tax, and third-party extensions.
Follow the full credential rotation procedure in order. Adobe specifies applying the hotfix first, then enabling maintenance mode and disabling cron before rotation. Its procedure ends with flushing the cache, re-enabling cron, and disabling maintenance mode.
Coordinate access before starting. Your developer may control Commerce but still need another person to rotate credentials in a payment provider or hosting account. Assign those tasks so the response can be completed without avoidable delays.
Check the store after the changes
Credential changes can affect the services your store relies on. We recommend checking the full order flow after the update: placing an order, authorizing payment, calculating shipping and tax, and passing the order to connected systems.
Include ERP or order management connections if your store uses them, along with scheduled jobs and any integrations that received new credentials. Record the results and assign any failures immediately.
Expect session disruption during encryption key rotation. Adobe states that rotation invalidates customer and Admin sessions, requiring those users to log in again. Its documentation excludes integration users from that statement, which is another reason to complete the separate integration credential work. See Adobe’s encryption key guidance.
Address signs of compromise separately
Because Adobe has confirmed exploitation, we recommend having your security or hosting team review available logs and recent changes alongside the remediation work. Unexpected Admin accounts, unfamiliar integrations, unexplained file changes, or unusual access activity warrant investigation.
A successful patch deployment establishes that the fix was applied. It does not establish whether someone accessed the store beforehand. If your team finds suspicious activity, preserve the relevant evidence and involve the people responsible for incident response.
For the business owner, the completion update should answer three questions:
- Has the hotfix been verified in production?
- Have the required keys, passwords, and credentials been rotated, including at external providers?
- Have the main store functions been checked, and is any security investigation still open?
Those answers give you a useful status report and make any remaining work visible.
Need help with your store?
If your team needs help checking its version or applying the Adobe Commerce security update, contact Atwix. Include your Commerce or Magento version, hosting setup, and whether the hotfix and credential rotation have already been completed.