Act nowKnown exploited

Advisory · CVE-2026-48356

Actively exploited file upload flaw in Adobe Commerce and Magento can execute arbitrary code

Adobe Commerce, Commerce B2B, Magento Open Source, and Commerce Events contain an unrestricted file upload flaw that can result in arbitrary code execution in the context of the current user when a victim interacts with a crafted URL or compromised page. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026. CVSS 3.1 9.3.

Advisory published October 27, 2026Independent summary
Vendor
Adobe
Product
Adobe Commerce
Identifier / CWE
CVE-2026-48356
CWE-434
Action timing
Nov 10, 2026
ELI5

Explain it like I’m five

The store accepts an uploaded file without properly checking what kind of file it is. An attacker can hand it a program dressed as a document, and the server ends up able to run it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted interaction prepared

    The attacker prepares an upload carrying a dangerous file type, reached through a crafted URL or compromised page.

  2. 02Victim interacts

    A victim visits the maliciously crafted URL or interacts with the compromised page, as Adobe's record requires.

  3. 03Dangerous file accepted

    The application stores the uploaded file without restricting its type.

  4. 04Code executes

    The uploaded file results in arbitrary code execution in the context of the current user, with scope changed.

What happened

CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal remediation due date of November 10, 2026. Adobe rates it critical at CVSS 3.1 9.3: Adobe Commerce is affected by an unrestricted upload of file with dangerous type vulnerability (CWE-434) that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session. Exploitation requires user interaction, and the scope is changed.

Adobe’s record lists Adobe Commerce up to 2.4.9 and the 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, and 2.4.4-p18 patch lines as affected, with the corresponding 2026-jul releases listed as fixed; Commerce B2B up to the 1.5.3 line, Magento Open Source up to 2.4.9 and its patch lines, and Commerce Events up to 1.20.0 are also listed, with Commerce Events 1.21.0 listed as fixed. The bulletin is APSB26-73.

What to do

  1. Inventory every Adobe Commerce, Magento Open Source, Commerce B2B, and Commerce Events installation, including staging and headless front ends, and note versions.
  2. Apply the APSB26-73 fixes: move Commerce and Magento installations to the 2026-jul release for their branch and Commerce Events to 1.21.0 or later.
  3. Until patched, restrict admin panel and upload endpoints to trusted networks where possible, and review web application firewall rules for upload abuse.
  4. Scan the media and upload directories and the web root for newly added executable files, and review access logs for upload requests followed by requests to the uploaded path.
  5. If a suspicious file or execution is found, isolate the store, reset admin and integration credentials, rotate API keys and payment integration secrets, and rebuild from a known-clean release.
  6. Verify deployed versions on every node behind the load balancer after updating.

Management note

A store platform flaw with a KEV listing and a two-week federal clock is a revenue incident waiting to happen: a compromised checkout leaks payment journeys and admin control at once. Patch first, then hunt the upload directories, because exploitation of upload flaws leaves files behind.