Why should I check my Magento version this week?
The Australian Cyber Security Centre (ACSC) reports active exploitation of a critical flaw in Adobe Commerce and Magento Open Source. It is tracked as CVE-2026-75650. A CVE is a public ID number for one known security flaw.
The ACSC says the flaw can let an outsider run code on the server without logging in, when the /graphql address is exposed. It says a patch came out on 7 September 2026.
On 24 September 2026, CISA added a Magento authorization flaw to its Known Exploited Vulnerabilities catalog. That list names flaws with evidence of real-world use. This is a good reason to check now, calmly and in order.
How do I check if my Magento store has the patch?
- Write down the exact version of Magento or Adobe Commerce your store runs. Your developer, host or deployment records will have it.
- Open Adobe's bulletin APSB26-146, which the ACSC points to, and find the fixed version for your release line.
- Compare the two. If yours is older than the fixed version, you are not patched.
- If an agency or host runs the store, ask them in writing which version is installed and the date it was updated.
The ACSC also advises asking any managed service or IT provider to confirm both patching and monitoring. A reply of "it's handled" is not a version number.
What should I do if my store is behind?
- Take a backup or snapshot first, if your host allows it, so you can roll back a bad update.
- Update to a version that includes the fix. The ACSC says to treat this as a priority.
- If no patch exists for your version, move to one that does. Otherwise restrict and monitor access, as the ACSC advises.
- Test the shop: browse, add to basket and check out on a test order.
- Write down the date and version you now run.
Which CVE number applies to my store?
The two government pages name different CVE numbers: CVE-2026-75650 from the ACSC and CVE-2026-71362 from CISA. They may describe separate flaws.
You do not need to settle that yourself. Check Adobe's bulletin for your version, and look up any CVE number in the National Vulnerability Database if you want the details.
A CVE number we left out
Our research could not read the National Vulnerability Database page for CVE-2026-53787, so nothing is said here about it. Only link a CVE to Magento once you have checked its details directly.
What signs should I look for after patching?
Patching closes the hole but does not show whether anyone used it earlier. The ACSC suggests watching for these signs:
- Scheduled tasks you did not create
- Log entries showing unusual template processing
- Failed notifications that used to work
- Other unusual activity on the server
CISA notes that US federal agencies must also check for compromise from before the patch. You can borrow that habit and ask your developer to review the logs.
Your host says "we've taken care of it". What next?
- Nothing. That reply is enough.
- Ask which version is now installed and the date it was patched.
- Delete the email and hope for the best.
Show the answer
B. The ACSC advises asking any managed provider to confirm patching and monitoring. A version number and a date give you something you can check.
What can an outside check tell me?
A website security check can only see what your site shows to the public. It cannot see inside your server or tell you which patches are installed there.
ScanDefend checks a website for outdated software versions that the site announces publicly.
You can see what a finding looks like in the public sample report.
Key terms
- Patch: A software update that fixes a known security flaw.
- CVE: A public ID number given to one known security flaw.
- KEV catalog: CISA's list of flaws with evidence of active exploitation.
- Remote code execution: A flaw that lets an outsider run commands on your server.
What to do
- Write down your exact Magento or Adobe Commerce version.
- Compare it with Adobe's bulletin APSB26-146.
- Update to a fixed version, or ask your host to do it.
- Ask your host or agency for the installed version and patch date in writing.
- Test browsing and checkout after the update.
- Ask a developer to review logs and scheduled tasks for anything unexpected.
Frequently asked questions
How do I find my Magento version?
Ask your developer or host, or check your deployment records. You need the exact version number to compare with Adobe's bulletin.
Does Magento Open Source need the patch too?
Yes. The ACSC names both Adobe Commerce and Magento Open Source in its alert.
What if my host manages updates?
Ask them to confirm the installed version and the patch date. The ACSC advises asking providers to confirm patching and monitoring.
How ScanDefend fits in
ScanDefend checks a website for outdated software versions that the site announces publicly.
Want to see what your own website shows the internet? Run a website security check.
Want to see what a finished report looks like? View the sample report.