CVE-2026-77774 – Adobe Commerce

This Adobe Commerce update fixes nine vulnerabilities. Three are Critical and six are High. The most serious is CVE-2026-75650, a template engine injection flaw that lets an attacker run arbitrary code without any user interaction. It has a CVSS score of 10.0, Critical severity. Attackers are actively exploiting CVE-2026-75650, so internet-facing stores are under direct threat.

CVE-2026-76200 and CVE-2026-76201 are stored cross-site scripting flaws. Each has a CVSS score of 9.3, Critical severity. They let attackers plant malicious scripts in form fields and take over victim accounts or sessions. The remaining six flaws allow privilege escalation and security feature bypass through incorrect authorization and path traversal. CVE-2026-76202 has a CVSS score of 8.2, High severity. CVE-2026-77108 has a CVSS score of 7.5, High severity. CVE-2026-77109 has a CVSS score of 8.6, High severity. CVE-2026-77110 has a CVSS score of 7.6, High severity. CVE-2026-77111 has a CVSS score of 8.7, High severity. CVE-2026-77774 has a CVSS score of 8.6, High severity. Together, these flaws expose sensitive data, restricted resources and unauthorized read and write access.