On September 7, 2026, Adobe published APSB26-146, addressing a Magento zero-day vulnerability tracked as CVE-2026-75650. Most security bulletins describe a risk that could be exploited. This one is different: Adobe states plainly that this vulnerability has already been exploited in the wild against Adobe Commerce merchants, before a fix was even available.

For anyone managing a Magento store, or the Magento Extensions running on top of one, that's the detail that should change how urgently this gets treated. Here's what happened, who's affected, and what the fix actually requires, which is more than a single patch.

What Happened

CVE-2026-75650 is an unauthenticated remote code execution flaw, meaning an attacker doesn't need a password, an admin account, or any prior access to potentially run code on an affected server. That's about as severe as a vulnerability gets, and it's why Adobe pushed this out as an urgent, out-of-cycle Adobe Commerce vulnerability bulletin instead of folding it into a routine patch cycle.

Most vulnerability disclosures describe a theoretical risk — a flaw a security researcher found and reported before anyone had a chance to misuse it. This one is different specifically because Adobe confirms real exploitation happened first. That single fact changes the entire response: it's no longer just about closing a gap, it's about figuring out whether that gap was already used against your store.

Which Versions Are Affected

  • Adobe Commerce — versions 2.4.4 through 2.4.9 (August 2026 patch level and earlier).
  • Adobe Commerce B2B — versions 1.3.3 through 1.5.3 (August 2026 patch level and earlier).
  • Magento Open Source — versions 2.4.6 through 2.4.9 (August 2026 patch level and earlier).

If your store sits anywhere in these ranges without the hotfix applied, this isn't a "get to it this month" situation.

The Fix: Hotfix VULN-39341, Plus a Full Credential Reset

Adobe has released a composer patch, VULN-39341, covering Adobe Commerce on Cloud, on-premises, and Magento Open Source. But applying the patch alone does not fully resolve this incident. Because the flaw allowed code execution, anything protected by your store's encryption key : integration tokens, payment gateway credentials, system-privileged automation tokens, should be treated as potentially exposed if you were running an affected version before patching.

Adobe's full remediation sequence, condensed:

  • Apply the hotfix, enable maintenance mode, and disable cron before doing anything else.
  • Rotate the encryption key, then every Admin panel password.
  • Regenerate all REST, SOAP, and GraphQL integration tokens, and rotate OAuth secrets for connected apps.
  • Rotate payment gateway credentials at the provider (Stripe, Braintree, Adyen, PayPal, etc.), not just inside Commerce.
  • Rotate database credentials, SSH/deploy keys, and any service account or cron credentials.
  • Rotate API keys for shipping, tax, and other third-party extensions, then flush cache and bring cron and the storefront back online.

What This Means If You Run Third-Party Extensions

This is the part that's easy to miss if you're focused only on the core platform. Many Magento 2 extensions, shipping calculators, tax connectors, marketing tools, store their own API keys or tokens inside Commerce, often encrypted with the same key this advisory tells you to rotate. After rotating your encryption key and Admin credentials, go back through your installed extensions and confirm each one that uses an API key or stored credential still authenticates correctly, and reissue any that don't. A patch that leaves an extension quietly disconnected is still a problem, just a quieter one.

Worth prioritizing in that review: anything that touches payments, shipping rate calculation, or customer data sync first, since those are the integrations most likely to fail loudly (and cause real order problems) if a rotated credential goes unnoticed. Extensions handling less time-sensitive tasks, like SEO tools or marketing tags, can usually wait a day without causing operational damage, but should still be checked before you consider the incident closed.

Why "Actively Exploited" Changes the Response

A normal advisory asks you to prevent a future problem. This one asks you to consider whether a past compromise already happened. Depending on what an attacker accessed before this was disclosed, that can touch payment compliance obligations and customer trust, not just server configuration. Treat the credential rotation step as mandatory, not optional, even if patching feels like the finish line.

How to Tell If Your Store Was Already Hit

Since this flaw was being used against real stores before the fix existed, it's worth checking for warning signs alongside patching, not just assuming the patch alone closes the loop:

  • Admin accounts you don't recognize, or existing accounts with permissions that look different than expected.
  • Integration tokens or API keys under System > Extensions > Integrations that your team didn't create.
  • Cron jobs or scheduled tasks that don't match your store's normal setup.
  • Unusual server load or outbound traffic flagged by your hosting provider around early September.
  • Core file or template changes that don't line up with a deployment your team actually made.

Spotting any of these doesn't confirm a breach on its own, but it's a strong signal to prioritize the credential rotation immediately and consider a closer look before treating this as resolved.

Frequently Asked Questions

Yes, if your store was running an affected version at any point before patching. The hotfix prevents further exploitation : it doesn't reverse anything that may have already been accessed while the store was vulnerable.
It can, temporarily, if a magento extension stores an API key or token that gets invalidated during rotation. That's exactly why checking each extension's connection status after rotating is a required step here, not an optional cleanup task.
Check the Admin panel footer or run `bin/magento --version` from the command line. If you're not certain whether your exact version and patch level is affected, the safer assumption is that it is, until you've confirmed otherwise.

Staying Ahead of the Next One

Following Magento security best practices means treating advisories like this one as a full incident-response checklist, not a single download. As a Magento extension store, VDCstore keeps its listed extensions tested against current platform releases, so compatibility isn't one more thing to guess about while you're already dealing with a credential rotation. If you have questions about how this advisory affects a specific extension you're running, or want a second set of eyes on your patch and rotation before you consider this closed, reach out and we'll help you work through it.