Adobe Issues Emergency Patch for Critical Magento Zero-Day Under Active Attack

Published: September 9, 2026 • Reading Time: 6 min read • Reporting: Intelligence Division

Adobe has released urgent security patches to address a CVSS 10.0 zero-day vulnerability affecting Adobe Commerce and Magento Open Source. The flaw is actively being exploited in the wild to deploy sophisticated Rust-based backdoors and PHP web shells.

Adobe has issued emergency updates to patch a critical vulnerability, tracked as CVE-2026-75650, which carries a maximum CVSS severity score of 10.0. The security flaw affects both Adobe Commerce and Magento Open Source platforms. According to security researchers, threat actors are actively exploiting this zero-day vulnerability in the wild. The attacks involve deploying highly sophisticated payloads, including a Rust-based backdoor and a PHP web shell, allowing attackers to gain persistent, unauthorized access to merchant servers. This compromise exposes sensitive transaction data, customer credentials, and intellectual property. Adobe has urged all enterprise customers and system administrators to apply the patches immediately to mitigate the risk of ongoing exploitation. The incident underscores the rising sophistication of attacks targeting enterprise e-commerce infrastructure, where legacy architectures are increasingly targeted by modern, compiled malware variants.