CVE-2026-48356
Attacker can upload malicious files to run code on Adobe Commerce stores
A critical vulnerability in Adobe Commerce lets an attacker upload a dangerous file that can execute arbitrary code on the victim's system. The flaw affects all Adobe Commerce installations and requires the victim to click a malicious link or visit a compromised page. CISA reports the vulnerability is actively being exploited and has added it to its known-exploited list.
Adobe Commerce and Magento · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 27 Oct; US agencies must fix by 10 Nov
SeveritycriticalCVSS 9.3 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply fixes from Adobe as soon as they are released, as no fixed versions are available yet.
- Until a fix is available, follow Adobe's workarounds if any are provided, as recommended by CISA.
- Monitor Adobe's security advisories and CISA's known-exploited list for updates.
What happened
- 27 OctCISA added the vulnerability to its known-exploited list and required US federal agencies to fix by 2026-11-10.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-48356 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | critical 9.3 | 27 Oct | 31% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 27 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗The records
helpx.adobe.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-48356 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works