Adobe Fastly Rules Breaking Magento Admin Saves? How to Safely Remove CVE-2026-75650 Rules

Adobe Commerce / Magento Security | CVE-2026-75650 | Fastly

If you recently applied Adobe’s emergency security response for CVE-2026-75650 and suddenly found that Magento Admin users can no longer save CMS pages, blocks, email templates, or other content containing template directives, the problem may not be Magento itself.

In Adobe Commerce Cloud environments, Adobe introduced additional Fastly VCL snippets as a virtual patch for CVE-2026-75650. These rules are designed to block malicious template-directive payloads before they reach Magento.

The problem is that legitimate Magento content can contain the same template-directive patterns.

As a result, the security rule can produce false positives and block legitimate Admin requests.

Important: Do not remove the Fastly rules as a substitute for patching CVE-2026-75650. The underlying Magento/Adobe Commerce security patch must be applied first.

Adobe’s official security bulletin confirms that CVE-2026-75650 is a critical, unauthenticated remote-code-execution vulnerability and that it has been exploited in the wild.

The Problem: Magento Admin Saves Return 403

One common symptom is that saving a CMS page or block from the Magento Admin suddenly stops working.

Depending on the particular request and Admin implementation, you may see:

• A Fastly 403 Forbidden response
• The Admin page returning to the edit screen without saving
• A JavaScript error because the expected JSON response was replaced by an HTML error page
• No corresponding Magento exception in var/log/exception.log
• No useful entry in var/log/system.log

The last point is particularly important.

If the request is being rejected by Fastly, it never reaches Magento.

Therefore, Magento’s application logs may contain nothing about the failed request.

A simple way to identify the problem

Try saving the same CMS page with ordinary text.

If it works, add a Magento template directive such as:

{{block class="..."}}

or:

{{widget type="..."}}

or:

{{media url="..."}}

and try saving again.

If the save fails only when the template directive is present, the Fastly security rule is a strong candidate.

Magento content legitimately uses template directives, which means a rule looking for these patterns can unintentionally block normal Admin activity.

What Adobe Added to Fastly

For Adobe Commerce on cloud infrastructure, the CVE-2026-75650 response can include custom Fastly VCL snippets named:

accord-rce
accord_rce_1

These snippets act as a virtual patch at the edge.

The intention is straightforward:

Client
   ↓
Fastly
   ↓
Security rule
   ↓
Magento Origin

A suspicious request can therefore be rejected before Magento processes it.

Fastly itself also provides a virtual patch for CVE-2026-75650 through its Next-Gen WAF functionality.

The difficulty with the Adobe VCL approach is that legitimate Magento content can resemble the payload patterns being blocked.

Do Not Delete the Rules Blindly

Before removing anything, record the existing VCL snippets.

Fastly service versions are important here because active versions are immutable. You should therefore work on a cloned version rather than attempting to modify the live configuration directly.

First identify the active version:

fastly service describe --service-id="$SID"

Then inspect the two Adobe snippets:

fastly service vcl snippet describe \
  --service-id="$SID" \
  --version=ACTIVE_VERSION \
  --name=accord-rce

fastly service vcl snippet describe \
  --service-id="$SID" \
  --version=ACTIVE_VERSION \
  --name=accord_rce_1

Replace:

ACTIVE_VERSION

with the actual active Fastly service version.

Save the output.

This is important because you may later want to build a more narrowly scoped security rule rather than removing the protection entirely.

Clone the Active Fastly Version

Fastly service versions cannot simply be edited once they are active.

Create a new version from the current active version:

fastly service-version clone \
  --service-id="$SID" \
  --version=active

Fastly will return a new version number, for example:

Version: 113

From this point forward, use your newly created version number.

For example:

113

Remove Both Adobe Snippets

Now remove both snippets from the cloned version:

fastly service vcl snippet delete \
  --service-id="$SID" \
  --version=113 \
  --name=accord-rce

and:

fastly service vcl snippet delete \
  --service-id="$SID" \
  --version=113 \
  --name=accord_rce_1

Remove both

It is easy to remove one and forget the other.

The names are slightly inconsistent:

accord-rce
accord_rce_1

Leaving either rule in place can mean that the Admin save request is still blocked.

Verify the VCL Configuration

Before activating the new version, list the snippets:

fastly service vcl snippet list \
  --service-id="$SID" \
  --version=113

Confirm that neither of the following appears:

accord-rce
accord_rce_1

At the same time, verify that your other VCL snippets are still present.

This is especially important if your Magento installation has additional security rules or custom Fastly configuration.

Validate Before Activation

Do not skip validation.

Run:

fastly service-version validate \
  --service-id="$SID" \
  --version=113

The reason is simple: deleting a VCL snippet can have side effects if another snippet depends on something that the removed snippet defined.

A VCL configuration that fails validation should not be activated.

Activate the New Version

Once validation succeeds:

fastly service-version activate \
  --service-id="$SID" \
  --version=113

Fastly activation should propagate the new version across the edge quickly.

Now return to Magento Admin and test the operation that was previously failing.

For example:

1. Open a CMS page.
2. Add or retain the required Magento template directive.
3. Save the page.
4. Confirm that the save succeeds.
5. Verify the resulting storefront content.

How to Roll Back

If something unexpected happens, you can activate the previous version.

For example, if the old version was:

112

rollback with:

fastly service-version activate \
  --service-id="$SID" \
  --version=112

This is one of the reasons why cloning and validating a new version is preferable to making uncontrolled changes to production configuration.

The Most Important Part: Removing the Rule Does NOT Fix CVE-2026-75650

This deserves emphasis.

The Adobe Fastly snippets are a virtual patch.

Removing them does not patch Magento.

CVE-2026-75650 is a critical vulnerability that can allow unauthenticated arbitrary code execution. Adobe has explicitly stated that exploitation was observed in the wild.

Therefore, the correct sequence is:

1. Apply the Magento / Adobe Commerce security fix
              ↓
2. Verify the security patch is actually applied
              ↓
3. Investigate the Fastly false positive
              ↓
4. Clone the active Fastly version
              ↓
5. Remove the problematic snippets
              ↓
6. Validate the VCL
              ↓
7. Activate the new version
              ↓
8. Test Magento Admin saves

Adobe Commerce Cloud: Verify the Cloud Patch

For Adobe Commerce Cloud projects, verify that the appropriate magento/magento-cloud-patches version is installed.

The referenced remediation uses the 1.1.21 cloud-patches release.

For example:

composer show magento/magento-cloud-patches

Then check the applied ECE patches:

vendor/bin/ece-patches status

You should specifically verify that the relevant security patch is applied rather than assuming that the package version alone means the fix is active.

Adobe’s security guidance provides the applicable hotfix information for supported Adobe Commerce and Magento Open Source versions.

Adobe Commerce / Magento Open Source Outside Cloud

If you are not running Adobe Commerce Cloud, the Fastly-specific remediation does not replace the Magento security patch.

Apply the appropriate VULN-39341 security fix for your Magento version.

After applying the patch, the normal deployment steps may include:

bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush

Always follow the installation instructions applicable to your exact Magento / Adobe Commerce version.

A Better Long-Term Approach

If your business requires an additional Fastly edge rule, consider creating a more narrowly scoped rule instead of simply removing the protection.

The important distinction is to avoid blocking legitimate Magento Admin traffic while still protecting the storefront and other externally exposed endpoints.

A carefully designed rule can be scoped around:

• The affected storefront endpoints
• Expected request methods
• Known malicious patterns
• Your actual Admin path
• Legitimate CMS/Admin operations

In other words:

Bad approach
────────────
Block template directives everywhere

Better approach
───────────────
Block malicious template payloads
where they can actually be exploited
while allowing legitimate Admin operations

The exact rule should be designed from the original Adobe VCL and your application’s architecture rather than copied blindly.

Why This Incident Is a Good Reminder

CVE-2026-75650 demonstrates an important lesson in Magento security:

A virtual patch and a permanent application patch are not the same thing.

Edge security controls are extremely valuable because they can provide protection while an application patch is being deployed.

But an edge rule that operates purely on request patterns can also create false positives.

Magento is a particularly interesting example because template directives are legitimate application functionality:

{{block ...}}
{{widget ...}}
{{media ...}}

Those same patterns can become security indicators when an attacker abuses a vulnerable template-processing path.

The challenge is therefore finding the right balance between:

Security

and

legitimate application functionality.

Final Checklist

Before considering the issue resolved, verify all of the following:

• CVE-2026-75650 security patch is installed.

• The applicable Adobe Commerce Cloud patch level is confirmed.

• accord-rce has been identified.

• accord_rce_1 has been identified.

• Existing snippets were backed up/documented.

• The active Fastly version was cloned.

• Both problematic snippets were removed from the new version.

• Remaining VCL snippets were verified.

• Fastly VCL validation succeeded.

• The new version was activated.

• Magento Admin CMS saves were tested.

• Template directives were tested.

• Storefront functionality was tested.

• Rollback version was identified.

Conclusion

If Adobe’s CVE-2026-75650 Fastly rules are causing Magento Admin content saves to fail, the issue may be a Fastly-layer false positive rather than a Magento application error.

The safe approach is not to disable security blindly.

First make sure the real CVE-2026-75650 application patch is installed. Then document the Adobe VCL snippets, clone the active Fastly version, remove the problematic accord-rce and accord_rce_1 snippets, validate the new configuration, and only then activate it.

For production Magento environments, always treat the Fastly configuration and Magento security patch as two separate layers of the remediation.

Patch Magento first. Fix the edge rule second.