NCSC-2026-0344 [1.00] [H/H] Kwetsbaarheid verholpen in Adobe Commerce en Magento
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Adobe heeft een kwetsbaarheid verholpen in Adobe Commerce en Magento. De kwetsbaarheid bevindt zich in de template engine van Adobe Commerce, waarbij speciale elementen niet correct worden geneutraliseerd. Een aanvaller kan hierdoor op afstand willekeurige code uitvoeren zonder dat er gebruikersinteractie nodig is. Dit gebeurt door misbruik te maken van een gewijzigde scope om privileges te escaleren of de uitvoeringcontext aan te passen. Adobe geeft aan dat deze kwetsbaarheid reeds actief wordt misbruikt.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0344
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-75650Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 81% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-75650 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploited[UPDATE] [kritisch] Adobe Magento Open Source: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode …cert-bund
- highexploited[NEU] [hoch] Adobe Magento: Mehrere Schwachstellencert-bund
- unknownexploitedAdobe Monthly Security Update (September 2026)hkcert
- unknownexploitedAdobe security advisory (AV26-888) – Update 1cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engi…cisa-kev
- unknownexploitedVulnérabilité dans les produits Adobe (08 septembre 2026)cert-fr-avis
- criticalexploitedCVE-2026-75650: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Templat…nvd
Recent advisories for Kwetsbaarheid verholpen in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0359 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobilencsc-nl · 2026-09-09
- unknownNCSC-2026-0357 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Sentryncsc-nl · 2026-09-09
- unknownexploitedNCSC-2026-0354 [1.00] [M/H] Kwetsbaarheid verholpen in Google Chromencsc-nl · 2026-09-09
- unknownexploitedNCSC-2026-0342 [1.00] [H/H] Kwetsbaarheid verholpen in N-central van N-ablencsc-nl · 2026-09-07
- unknownexploitedNCSC-2026-0336 [1.00] [M/H] Kwetsbaarheid verholpen in JFrog Artifactoryncsc-nl · 2026-09-02
- unknownexploitedNCSC-2026-0324 [1.00] [M/H] Kwetsbaarheid verholpen in Zimbra Collaboration Suitencsc-nl · 2026-08-23
More from NCSC-NL Advisories
- unknownNCSC-2026-0365 [1.00] [H/H] Kwetsbaarheden verholpen in Check Point VPN producten2026-09-10
- unknownNCSC-2026-0364 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Illustrator2026-09-09
- unknownNCSC-2026-0363 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Experience Manager2026-09-09
- unknownNCSC-2026-0362 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe ColdFusion2026-09-09
- unknownNCSC-2026-0361 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Commerce2026-09-09