Adobe has released an urgent security update for Adobe Commerce and Magento Open Source after confirming that attackers have exploited a critical vulnerability against merchants. The vulnerability, CVE-2026-75650 , can allow an attacker to execute code on an affected installation without logging in. Adobe published the fix on September 7 under APSB26-146 , assigning it a critical severity rating, a CVSS score of 10. For store owners, the immediate job is to get your development team working on the response. That includes applying the hotfix, rotating encryption keys and potentially exposed credentials, and confirming that the work is complete in production.