Open-source business platforms week 37 2026: exploited Adobe Commerce flaw among 17 vulnerabilities

The release at a glance

During the week of 7–13 September 2026, maintainers of Adobe Commerce/Magento, Dolibarr, TYPO3, Frappe/ERPNext, WooCommerce and PrestaShop released 17 vulnerabilities; 15 carry CVE ids and two are security advisories without CVE ids. Three are rated critical, ten high, three medium and one unscored. Adobe Commerce / Magento accounts for nine of the entries. CVE-2026-75650, a CVSS 10 template engine vulnerability in Adobe Commerce, is exploited and is listed in CISA KEV; CISA added it on 8 September 2026 with a due date of 11 September 2026, and ENISA EUVD records exploitation since 8 September 2026.

What matters most

Adobe Commerce / Magento. CVE-2026-75650 is the exploited template-engine vulnerability: network-accessible, no credentials or user interaction, changed scope, arbitrary code execution. CVE-2026-76201 and CVE-2026-76200 are stored XSS flaws scored 9.3; malicious JavaScript can run in a victim's browser and potentially gain elevated access or control over the account or session. CVE-2026-77111 and CVE-2026-77774 are incorrect authorization flaws that can bypass security features and grant unauthorised write or read access. The remaining Adobe Commerce authorization and path traversal issues in this release are fixed by the September 2026 releases.

Dolibarr. CVE-2026-89013 allows an unauthenticated attacker to read arbitrary files through document storage endpoints by supplying hashp=shared, including logs, uploaded business documents, database backups containing password hashes and files belonging to other multi-company entities. Fixed in Dolibarr 24.0.1.

WooCommerce. CVE-2026-48888 before 11.1.0 permits an unauthenticated HTTP denial of service. Fixed in WooCommerce 11.1.0.

TYPO3 CMS. CVE-2026-85400 lets backend administrators without system maintainer privileges schedule configuration read, set and show commands, allowing modification of system configuration. Fixed in TYPO3 CMS 14.3.7.

Patch in this order

1. Adobe Commerce / Magento: apply the Adobe Commerce, Adobe Commerce B2B and Magento Open Source hotfixes for CVE-2026-75650 first. CISA KEV gives a due date of 11 September 2026.
2. Dolibarr: update to 24.0.1. CVE-2026-89013 is unauthenticated, network-accessible and automatable.
3. Adobe Commerce / Magento: move Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3 and Magento Open Source 2.4.6–2.4.9 onto the September 2026 releases to address the stored XSS and incorrect authorization flaws.
4. WooCommerce and TYPO3 CMS: update WooCommerce to 11.1.0 and TYPO3 CMS to 14.3.7. For the remaining PrestaShop and Frappe Framework advisories, follow maintainer guidance as published.

Beyond the patch

For a release built around internet-facing commerce and ERP platforms, next month is about maintaining visibility and detection rather than chasing each CVE individually. Managed Detection & Response (MDR) is the first line for exploited flaws such as CVE-2026-75650; Virtual CISO Services (vCISO) keeps an exposure picture across these network-reachable services, and Implementation & Assessment Services covers public shop platforms with penetration testing and hardening reviews.