Patching Guide for CVE-2026-75650: Closing the Adobe Commerce RCE

Adobe Commerce and Magento Open Source, including B2B versions, contain a critical remote code execution (RCE) flaw (CVE-2026-75650). CERT-In rates the advisory as CRITICAL due to confirmed exploitation. This guide outlines the steps to mitigate the vulnerability.

First, create a comprehensive inventory of all affected deployments, including production storefronts, staging, QA, preview environments, and B2B installations. The vulnerable versions span from 2.4.9-2026-aug and earlier for Adobe Commerce and Magento Open Source, as well as 1.5.3-2026-aug and earlier for Adobe Commerce B2B, and 2.4.9-2026-aug and earlier for Magento Open Source.

Next, apply the vendor-provided updates outlined in advisories apsb26-138 and apsb26-146. Standard practices apply: create a verified backup, apply the update in a non-production environment first, and maintain consistent deployment tooling for reproducibility.

After applying the patch, verify the version number on the application itself. Confirm the version falls outside the ranges listed in the advisories by checking every node behind the load balancer, not just the first one.

While patching, consider reducing exposure by restricting network access to the application, administrative and API paths, and blocking anomalous requests. These measures are supplemental to the vendor's fix.

Given that Adobe has confirmed active exploitation, internet-facing commerce hosts with the affected version should be treated as potentially compromised. Review administrative accounts for unauthorized additions, inspect templates and files for modifications, and examine outbound connections for signs of command-and-control or exfiltration activities.