Adobe Commerce and Magento Under Active Attack: What Australian Businesses Need to Do Now

SwiftTech Weekly Cybersecurity Update — 14 September 2026

Australian businesses that run online stores on Adobe Commerce or Magento Open Source should treat this week’s security warning as urgent. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) issued a Critical alert on 9 September 2026 after becoming aware of reported active exploitation of CVE-2026-75650, a critical vulnerability affecting Adobe Commerce and Magento Open Source.

The issue is especially important because exploitation does not require an attacker to have a valid account. Adobe’s APSB26-146 security bulletin rates the vulnerability Critical with a CVSS score of 10.0, and says successful exploitation can lead to arbitrary code execution. ASD’s ACSC also says there are a substantial number of potentially vulnerable instances within the Australian economy.

For a business owner, the message is straightforward: if your website, e-commerce store, developer or hosting provider uses Adobe Commerce or Magento Open Source, confirm that the required hotfix has been applied and that the environment is being checked for suspicious activity.

Why SwiftTech Selected This Topic This Week

This is the strongest topic for Australian small and medium businesses this week because it combines three important risk factors: confirmed active exploitation, a maximum CVSS score, and a direct warning from Australia’s national cyber security authority that many potentially vulnerable systems exist in the Australian economy.

Unlike a vulnerability that exists only in theory, active exploitation means attackers are already attempting to use the weakness against real systems. Businesses should therefore prioritise remediation rather than waiting for their normal maintenance cycle.

What Are Adobe Commerce and Magento Open Source?

Adobe Commerce and Magento Open Source are PHP-based e-commerce platforms used to run online stores. They can sit at the centre of a business’s sales operation and may connect with customer accounts, product databases, payment-related services, inventory systems, email platforms, shipping integrations, APIs and other business systems.

That makes an e-commerce platform a high-value target. A compromise may affect more than the public website itself. Depending on the configuration and the attacker’s access, the incident can create risks to business data, connected services, customer trust and day-to-day operations.

What Is CVE-2026-75650?

Adobe describes CVE-2026-75650 as an improper neutralisation vulnerability involving special elements used in a template engine. In practical terms, the flaw can allow unauthenticated remote code execution.

ASD’s ACSC states that exploitation requires the affected platform’s /graphql endpoint to be exposed. Adobe’s security bulletin gives the vulnerability a CVSS base score of 10.0 and confirms that exploitation has been observed in the wild.

Adobe released the relevant hotfix on 7 September 2026. The company recommends that customers apply the hotfix and update their installation to the newest supported version.

Who Is Affected?

Adobe’s advisory lists affected Adobe Commerce, Adobe Commerce B2B and Magento Open Source branches. The safest approach is not to assume that a store is protected based on its product name or approximate version. The person responsible for the platform should compare the exact installed version and patch status against Adobe’s current APSB26-146 security bulletin.

If your store is managed by a developer, hosting company, managed service provider or enterprise IT provider, ask them for written confirmation that the CVE-2026-75650 hotfix has been applied and that the environment has been reviewed for suspicious activity. This is also specifically recommended by ASD’s ACSC.

Why This Matters to Small and Medium Businesses

Many business owners outsource their website and e-commerce maintenance, which can create a dangerous assumption: “the developer handles security”. Outsourcing the technical work is sensible, but the business still needs visibility into whether critical systems are patched and monitored.

An online store can be business-critical infrastructure. If it is compromised or taken offline, the impact may include lost sales, service disruption, emergency remediation costs and reputational damage. If an attacker gains access to connected systems or sensitive information, the incident may become significantly more serious.

This is why SwiftTech recommends treating internet-facing business platforms as part of your wider cybersecurity strategy, rather than viewing website security as a separate issue.

What Australian Businesses Should Do Now

1. Confirm Whether Adobe Commerce or Magento Is in Use

Ask whoever manages your website which platform and exact version your online store uses. Do not rely only on what the website looks like from the outside.

2. Apply the CVE-2026-75650 Hotfix Immediately

Adobe released its Priority 1 hotfix on 7 September. If your environment is affected, apply the vendor hotfix as a priority and move to the newest supported secure release where appropriate.

3. Review GraphQL Exposure

ASD’s ACSC states that exploitation requires the /graphql endpoint to be exposed. Your technical provider should review whether that endpoint needs to be publicly reachable and ensure that unnecessary exposure is reduced.

Reducing unnecessary external access is a fundamental security principle. SwiftTech can assist businesses with network infrastructure and security reviews where internet-facing services and network controls need assessment.

4. Look for Signs of Suspicious Activity

Patching closes the known vulnerability, but it does not prove that a previously vulnerable server was never accessed. ASD’s ACSC recommends monitoring for unusual system activity, unexpected scheduled tasks and suspicious log entries, including unusual template processing or failed notifications.

If suspicious activity is identified, preserve relevant logs and evidence and escalate the matter promptly. Australian organisations can report or seek assistance from ASD’s ACSC through 1300 CYBER1.

5. Check Connected Systems and Credentials

If compromise is suspected, review more than the web server. Identify what the e-commerce platform can access: databases, API keys, cloud services, administration accounts, email systems, payment integrations, deployment tools and other connected services.

Potentially exposed credentials should be rotated as part of a controlled incident response. Administrative privileges should also be reviewed so that the e-commerce platform and its service accounts have only the access they genuinely require.

6. Make Patch Management a Business Process

The broader lesson is that critical patches need an owner, a deadline and verification. A vulnerability can be publicly fixed while a business remains exposed simply because nobody confirmed that the update was deployed.

Application patching is also one of the mitigation strategies in the Australian Cyber Security Centre’s Essential Eight. SwiftTech can help organisations review their approach through our Essential Eight implementation services.

7. Maintain Reliable Backups and Recovery Options

Backups do not replace patching, but they are essential to resilience. Important website data, databases, configuration information and business systems should have protected backups with tested recovery procedures.

SwiftTech provides data protection, backup and recovery solutions for businesses that need stronger recovery capability.

If a Third Party Manages Your Store

Send your provider a short, direct request: “Please confirm whether our environment is affected by CVE-2026-75650, whether Adobe’s hotfix has been applied, whether the GraphQL endpoint is exposed, and whether logs have been reviewed for signs of exploitation.”

A clear answer should include the installed version, patch status and what monitoring or investigation has been completed. “Automatic updates are enabled” is not the same as confirming that a specific emergency hotfix has been successfully installed.

The Bigger Lesson: Internet-Facing Systems Need Active Maintenance

Websites, remote-access platforms, firewalls, cloud portals and business applications are constantly exposed to automated scanning and attack attempts. When a critical vulnerability becomes public, the time between disclosure and exploitation can be short.

Businesses need a repeatable process for knowing what they run, who is responsible for it, when critical patches are released, whether those patches were actually installed and how suspicious activity would be detected.

This is the same layered approach behind SwiftTech’s broader cybersecurity and IT security services: reduce exposure, patch quickly, restrict privilege, monitor systems and maintain recoverable backups.

Frequently Asked Questions

Is CVE-2026-75650 actively exploited?

Yes. Adobe says it is aware of CVE-2026-75650 being exploited in the wild, and ASD’s ACSC issued a Critical alert on 9 September 2026 after becoming aware of reported active exploitation.

How serious is the vulnerability?

Adobe rates CVE-2026-75650 Critical with a CVSS base score of 10.0. It can lead to arbitrary code execution without authentication.

Does an attacker need a Magento administrator account?

No. Adobe states that authentication is not required. ASD’s ACSC says exploitation requires the affected platform’s /graphql endpoint to be exposed.

Is installing the patch enough?

Installing the hotfix is essential, but organisations that may have been exposed should also review logs and system activity for evidence of attempted or successful exploitation.

What should I ask my website provider?

Ask them to confirm the exact platform version, whether the CVE-2026-75650 hotfix has been applied, whether the GraphQL endpoint is exposed, and whether the environment has been checked for suspicious activity.

How SwiftTech Can Help

If you are unsure whether your business systems are exposed, SwiftTech can assist with practical IT and cybersecurity reviews. Our services include cybersecurity assessments, Essential Eight implementation, business IT support, network security, Microsoft 365 security, monitoring, patch management, backup and disaster recovery.

Contact SwiftTech to discuss a cybersecurity or IT security review for your business.

Adobe Commerce and Magento Under Active Attack