Adobe Commerce/Magento Open Source Arbitrary Code Execution (APSB26-146)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344801);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2026-75650");

  script_name(english:"Adobe Commerce/Magento Open Source Arbitrary Code Execution (APSB26-146)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Commerce/Magento Open Source instance installed on the remote host is missing a security hotfix.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Commerce/Magento Open Source installed on the remote host is affected by a vulnerability as
referenced in the APSB26-146 advisory.

  - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine
    vulnerability that could result in arbitrary code execution in the context of the current user. An attacker
    could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user
    interaction. Scope is changed. (CVE-2026-75650)

Adobe resolved this issue with the VULN-39341 hotfix rather than with a new release, so applying the fix does not
change the version that Adobe Commerce / Magento Open Source reports. This plugin only reports a host when the fix is
absent from the installation, so an affected version that already carries the hotfix is not flagged.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number and on the presence of the vendor hotfix in the installation.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/magento/apsb26-146.html");
  # https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?78a58ae4");
  script_set_attribute(attribute:"see_also", value:"https://sansec.io/research/stylesmuggler-0day");
  script_set_attribute(attribute:"solution", value:
"Apply the VULN-39341 hotfix as referenced in the vendor advisory, then rotate the encryption key and every credential
that may have been encrypted or exposed with it.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-75650");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:commerce");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:magento");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_commerce_nix_installed.nbin");
  script_require_ports("installed_sw/Adobe Magento", "installed_sw/Adobe Commerce");

  exit(0);
}

include('vdf.inc');

# No fixed release exists for this CVE - only the VULN-39341 hotfix, which does not change the reported version. The
# install detection records an 'Applied Hotfixes' entry when the hotfix marker is present, so each check only fires on
# an affected version that does NOT already carry the fix.
# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [{'scope': 'target', 'match': {'os': 'linux'}}],
  'checks': [
    {
      'check_algorithm': 'default',
      'product': {'name': 'Adobe Commerce', 'type': 'app'},
      'requires': [{'scope': 'install', 'not_contains': {'Hotfix Applied': 'VULN-39341'}}],
      'constraints': [
        {'min_version': '2.4.4.0', 'max_version': '2.4.9.999', 'fixed_display': 'Apply hotfix VULN-39341'}
      ]
    },
    {
      'check_algorithm': 'default',
      'product': {'name': 'Adobe Magento', 'type': 'app'},
      'requires': [{'scope': 'install', 'not_contains': {'Hotfix Applied': 'VULN-39341'}}],
      'constraints': [
        {'min_version': '2.4.6.0', 'max_version': '2.4.9.999', 'fixed_display': 'Apply hotfix VULN-39341'}
      ]
    }
  ]
};

var vdf_res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_res);