CVE-2026-48356

CRITICAL CISA KEV

ACT NOW Priority: 5.49 BB Relevance: 79/100

Published: 2026-07-14 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: Required

S: Changed

C: High

I: High

A: None

Description

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

CISA Known Exploited Vulnerability

Vendor / Product Adobe — Commerce and Magento

Date Added 2026-10-27

Remediation Due 2026-11-10

https://www.adobe.com/trust/security/products/commerce/apsb26-73.html ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48356

Weakness Classification (1)

CWE-434

Affected Software (350)

Vendor	Product	Version
Adobe	Adobe Commerce	0
Adobe	Adobe Commerce	0
Adobe	Adobe Commerce B2B	0
Adobe	Adobe Commerce B2B	0
Adobe	Adobe Commerce Events	0
Adobe	Adobe Commerce Events	0
Adobe	Magento Open Source	0
Adobe	Magento Open Source	0
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.4
adobe	commerce	2.4.5
adobe	commerce	2.4.5
adobe	commerce	2.4.5