An emergency Commerce hotfix also starts a compromise hunt

What happened: an exposed GraphQL endpoint can become a code-execution path

The vulnerability affects Adobe Commerce, Adobe Commerce B2B and Magento Open Source across multiple supported release lines. The ACSC describes it as improper neutralisation of special elements in a template engine and says exploitation requires the /graphql endpoint to be exposed. Adobe confirms exploitation in the wild and assigns its highest priority rating to the update.

Adobe provides version-specific hotfixes rather than a single universal package. Its updated implementation guidance covers current and earlier versions, including Commerce and Magento Open Source releases in the 2.4.4 through 2.4.9 families. That makes accurate inventory important: a generic statement that a store is 'on 2.4' is not enough to select, apply or prove the correct remediation.

Why it matters: patch success does not erase pre-patch exposure

An internet-facing commerce platform sits close to customer accounts, orders, integrations and payment workflows. Unauthenticated remote code execution can give an attacker a foothold without first stealing a user password. Even when the hotfix installs cleanly, secrets accessible to the application may have been exposed during the vulnerable period.

Adobe therefore instructs operators to rotate the Commerce encryption key and every credential that could have been encrypted or exposed through it. The list includes administrator passwords, REST, SOAP and GraphQL integration tokens, OAuth secrets, payment-gateway credentials, database passwords, deployment keys, privileged service accounts and third-party extension keys. Rotating only the platform encryption key does not invalidate copies an attacker may already hold.

The practical implication: treat remediation as four linked workstreams

First, identify every Commerce and Magento instance, including development, staging, dormant and provider-managed environments. Record its precise version, internet exposure, /graphql reachability, owner and applicable hotfix. If a managed service provider or enterprise IT partner operates the platform, require written confirmation of the exact patch and monitoring action rather than assuming responsibility transferred with the contract.

Second, apply the vendor hotfix under an emergency change process and verify the result. Adobe notes that successful application is not always easy to determine and supplies a Quality Patches Tool status check for Commerce on Cloud. Retain the patch identifier, command output, deployment time and functional checks for checkout, authentication, integrations and scheduled jobs.

Third, rotate credentials in a controlled sequence after patching so replacement secrets are not exposed through the same flaw. Coordinate payment providers and connected applications, disable cron where Adobe directs, invalidate old tokens at their source, flush caches and confirm that integrations use only the new credentials.

Finally, investigate the interval before remediation. Review web, application, operating-system and identity telemetry for unusual template processing, failed notifications, unexpected scheduled tasks, unfamiliar administrators, changed files, new processes, outbound connections and anomalous API activity. Preserve evidence and escalate suspicious findings; patch completion is a milestone, not proof that compromise did not occur.