Critical Adobe Commerce and Magento flaw under active attack

What happened

In September 2026 the ASD’s ACSC issued an alert about reported active exploitation of CVE-2026-75650, a critical vulnerability in Adobe Commerce and Magento Open Source, the PHP-based platforms behind many online stores.

The flaw lets an attacker run code on the store’s server without logging in, through the store’s GraphQL endpoint. Adobe released a patch on 7 September 2026. The ACSC said it was aware of a substantial number of potentially vulnerable stores in Australia.

Why it matters for online retailers

An attacker who can run code on your store server can:

• Inject card-skimming code into the checkout, stealing customers’ payment details as they type
• Steal customer names, addresses and order history
• Change prices, products or payment settings
• Use the server to attack others

Card-skimming attacks can run unnoticed for weeks, and the consequences include chargebacks, payment provider penalties, notification obligations and lost customer trust.

What to do

• Find out if you’re affected. If your store runs on Adobe Commerce or Magento, check which version you use.
• Apply the patch as a priority, or update to a version that includes it.
• If you can’t patch straight away, restrict and monitor access, and watch for unusual activity, unexpected scheduled tasks and suspicious log entries.
• Ask your developer or hosting provider to confirm the patch is applied and that they’re monitoring for suspicious activity, if they manage the store.
• Check your checkout. Have someone review checkout pages and payment scripts for code you didn’t add.

If you think your store was compromised

Contact your developer and payment provider straight away, keep evidence, and work out whether customer information was accessed. You may need to notify affected customers and the OAIC. See our guides on reporting data breaches and what to do if your website is hacked.

Where to get help

Call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) for advice, and report through ReportCyber.