September 8 Security Briefing: Adobe Commerce, JetBrains, and Endpoint PoCs

Today’s Major Security Issues

This briefing focuses on three operationally distinct developments. Adobe has confirmed in-the-wild exploitation of a critical template-engine vulnerability in Adobe Commerce and Magento Open Source and issued a Priority 1 hotfix. JetBrains disclosed a broad set of access-control fixes across YouTrack, Hub, IntelliJ IDEA, and GoLand. Separately, public proof-of-concept code targeting endpoint security products and an NVIDIA Windows driver shows why defensive software itself belongs in asset and change-management programs.

The response paths should not be collapsed into one checklist. Internet-facing commerce servers need emergency patching and compromise review. JetBrains server products and developer tools need product-specific inventory and fixed-build validation. The proof-of-concept disclosures require vendor-by-vendor mitigation tracking without treating public code as evidence that an organization has been breached.

At a Glance

• Adobe Commerce and Magento Open Source: CVE-2026-75650 can enable unauthenticated remote code execution. Adobe says it is being exploited and has published a dedicated Priority 1 hotfix.
• JetBrains: 29 newly published CVEs include YouTrack Helpdesk account takeover, unauthenticated Hub superuser access, remote-development host code execution, and a missing trust prompt before Dev Container builds.
• Nightmare Eclipse PoCs: public code targets an Avast-family sandbox, CrowdStrike Falcon’s Office macro-remediation feature, and NVIDIA Windows driver shared memory. Vendor response stages differ.

Threat Signal

Adobe’s explicit confirmation of exploitation is the strongest signal in this cycle. CVE-2026-75650 is reachable over the network without authentication or user interaction, so exposed systems warrant an emergency change window rather than the next routine maintenance slot. The JetBrains issues are serious, but the public records do not justify claiming active exploitation; organizations should identify exposed functions and move to fixed builds.

Public PoC code is a different signal. It lowers the cost of validation for defenders and can also accelerate hostile testing, but it does not prove exploitation. Gen Digital’s fix status, CrowdStrike’s feature-specific mitigation, and NVIDIA’s investigation should therefore be tracked separately.

Major Incident and Exploitation Update

Adobe Commerce: Active Exploitation and a Priority 1 Hotfix

Adobe’s September 7 bulletin APSB26-146 tracks the template-engine issue as CVE-2026-75650. Successful exploitation can lead to arbitrary code execution in the commerce application context, and no credentials are required. Adobe assigned its highest update priority and linked a dedicated hotfix.

The affected scope covers August 2026 trains and earlier across Adobe Commerce 2.4.4 through 2.4.9, the corresponding B2B lines, and Magento Open Source 2.4.6 through 2.4.9. Inventory should distinguish product, maintenance train, individual nodes, and hotfix state instead of relying on a single platform label.

1. Inventory externally reachable commerce, admin, and API endpoints, including load-balanced and disaster-recovery nodes.
2. Validate and deploy Adobe’s CVE-2026-75650 hotfix to every node before restoring normal traffic.
3. Review administrator changes, template and module modifications, scheduled jobs, unexpected PHP processes, and outbound connections.
4. Clear cache and sessions, rotate exposed application secrets by risk, and retest checkout, payment, and administration workflows.

JetBrains Access-Control Fixes

JetBrains’ September 7 set contains 29 CVEs spanning collaboration servers and developer endpoints. CVE-2026-86478 could allow unauthenticated account takeover in YouTrack Helpdesk through a self-asserted email address. CVE-2026-86480 could allow an unauthenticated attacker to register a trusted service in Hub and obtain superuser privileges.

The remaining YouTrack fixes include restricted REST resource access, cross-tenant exposure of GitHub App installation tokens, group-membership privilege escalation, disclosure of private issues and searches, webhook validation weaknesses, and stored XSS. Organizations using Helpdesk, VCS webhooks, GitHub Apps, or mailbox integrations should map those functions to each server.

On developer systems, IntelliJ IDEA before 2026.2.2 and GoLand before 2026.2.2.1 require attention. The IntelliJ set includes a missing trust confirmation before Dev Container builds and an IJent gRPC boundary issue that could lead to code execution on remote-development hosts.

1. Inventory YouTrack and Hub versions together with Helpdesk, REST, webhook, GitHub App, and mailbox exposure.
2. Move YouTrack to the fixed build in its supported train and Hub to 2026.2.52442 or later, then review service registrations and integration tokens.
3. Move IntelliJ IDEA to 2026.2.2 or later and GoLand to 2026.2.2.1 or later, including individually installed developer copies.
4. Review new administrative rights, unfamiliar trusted services, token use, suspicious webhook traffic, and unexpected remote-host processes.

New Priority CVEs

The top handoff priorities are CVE-2026-75650, CVE-2026-86478, and CVE-2026-86480. They combine active exploitation and unauthenticated code execution in Adobe Commerce with account takeover and superuser paths in JetBrains services. Other high-severity JetBrains access and code-execution issues should be researched independently, while lower-severity items can be validated as part of the same product update cycle.

The Nightmare Eclipse disclosures have not been forced into the CVE handoff without identifiers. Gen Digital has addressed the underlying Avast issue, CrowdStrike is investigating and has advised customers to disable the Microsoft Office File Suspicious Macro Removal policy, and NVIDIA is investigating the driver claim. Administrators should use official channels and avoid unofficial replacement drivers or patches.

1. Confirm that Avast, AVG, and Norton installations have received the latest vendor updates and completed any required restart.
2. CrowdStrike customers should follow the FalconFlank technical alert for the Office macro-removal setting without disabling unrelated protection.
3. Track NVIDIA’s official driver findings and correlate privilege, DWM, and driver-crash anomalies with endpoint telemetry.
4. Do not run public PoC files in production. Use an approved isolated test environment and vendor detection guidance.

Operational Notes

Prioritize by exposure and evidence. Start immediate hotfixing and compromise review on exposed Adobe Commerce and Magento systems. Sequence JetBrains server updates by authentication and integration exposure, then verify managed and unmanaged IDE installations. For endpoint security tools and GPU drivers, prefer narrowly scoped vendor guidance plus telemetry over broad feature removal.

Validation should also remain product-specific: test commerce and secret rotation on Adobe systems, access boundaries and integrations on YouTrack and Hub, project trust and remote development in IDEs, and protection-policy state on endpoint agents. This separation keeps patching, incident response, and temporary mitigation from being confused.