{"id":"adobe-commerce-magento-file-upload-cve-2026-48356","category":"patch","status":"live","title":"Adobe Commerce and Magento file upload flaw CVE-2026-48356 added to CISA's exploited list; July patches available","tldr":"CISA says attackers are using CVE-2026-48356, a critical file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026. Store owners should apply the July patch for their version and check for files uploaded earlier, since patching doesn't remove them.","summary":"CVE-2026-48356 is an unrestricted file upload flaw in Adobe Commerce, Commerce B2B and Magento Open Source, the software behind many online shops. Adobe fixed it on 14 July 2026 in bulletin APSB26-73 and rated it Critical, scoring it 9.6 (the public CVE and NVD records say 9.3). It needs no login but does need a user to take an action. CISA added it to its list of flaws used in attacks on 27 October 2026. Adobe's bulletin, last updated 11 August, still says it knows of no exploits in the wild, so the exploitation claim comes from CISA. Security firm Sansec says attempts began in March 2026, but Adobe and CISA haven't confirmed that. Adobe has released patches for every affected product line, as isolated patches that apply only to the newest patch level of each line. Patching doesn't remove files an attacker already uploaded. The advisory covers other flaws too, some also rated Critical. This mainly affects online shop operators, not ordinary shoppers.","action":"If you run an Adobe Commerce or Magento Open Source shop, apply the July 2026 patch for your version (or upgrade to the latest patch level first) and ask your developer to check for suspicious uploaded files. Shoppers have nothing to update.","product":"Adobe Commerce, Commerce B2B and Magento Open Source (online shop software)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48356"],"tags":["adobe","magento","adobe-commerce","file-upload","cisa-kev","ecommerce","polyshell"],"affected":["Adobe Commerce 2.4.9; 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier","Adobe Commerce B2B 1.5.3; 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier","Magento Open Source 2.4.9; 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier","Adobe Commerce Events 1.6.0 to 1.20.0"],"fixed":["Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul","Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul","Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul","Adobe Commerce Events 1.21.0"],"matches":[],"sources":[{"kind":"advisory","title":"APSB26-73 Security updates available for Adobe Commerce and Magento Open Source","url":"https://www.adobe.com/trust/security/products/commerce/apsb26-73.html","by":"Adobe","date":"2026-08-11"},{"kind":"research","title":"Adobe Commerce and Magento CVE-2026-48356 file upload RCE added to CISA KEV, October 2026","url":"https://rescana.com/post/adobe-commerce-magento-cve-2026-48356-file-upload-rce-kev-october-2026","by":"Rescana","date":"2026-10-27"}],"started":"2026-10-27","closed":null,"created":"2026-11-03T21:54:13.584Z","updated":"2026-11-03T21:54:13.584Z","cve_notes":[{"cve":"CVE-2026-48356","name":"Unrestricted file upload in Adobe Commerce and Magento","what":"An unrestricted file upload flaw in Adobe Commerce and Magento Open Source that lets an attacker get a dangerous file onto a shop and run code, with no login needed but some user interaction.","severity":"critical","cvss":9.6}],"timeline":[{"at":"2026-10-27","added":"2026-11-03T21:52:22.804Z","kind":"wider-attacks","text":"Security firm Sansec, as relayed by Rescana, reports exploitation attempts from March 2026, a mass attack wave on 30 March, and a link to a script-loader campaign on 24 October. Adobe and CISA have not confirmed these details, and no indicators of compromise have been published.","url":"https://rescana.com/post/adobe-commerce-magento-cve-2026-48356-file-upload-rce-kev-october-2026","by":"Rescana","patch":null},{"at":"2026-10-27","added":"2026-11-03T21:52:22.804Z","kind":"cisa-added","text":"CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities list, marking it as used in attacks. US federal agencies must fix it by 10 November 2026.","url":"https://rescana.com/post/adobe-commerce-magento-cve-2026-48356-file-upload-rce-kev-october-2026","by":"Rescana","patch":null},{"at":"2026-08-11","added":"2026-11-03T21:52:22.804Z","kind":"vendor-revised","text":"Adobe updated the bulletin. The page does not say what changed, and it still states that Adobe is not aware of exploits in the wild.","url":"https://www.adobe.com/trust/security/products/commerce/apsb26-73.html","by":"Adobe","patch":null},{"at":"2026-07-14","added":"2026-11-03T21:52:22.804Z","kind":"disclosed","text":"Adobe published bulletin APSB26-73 for Adobe Commerce, Commerce B2B, Magento Open Source and Commerce Events. It fixed CVE-2026-48356, an unrestricted file upload rated Critical (CVSS 9.6), with July 2026 patches. Adobe said it knew of no exploits in the wild.","url":"https://www.adobe.com/trust/security/products/commerce/apsb26-73.html","by":"Adobe","patch":"patched"}],"url":"https://hard.fyi/live/adobe-commerce-magento-file-upload-cve-2026-48356/","json":"https://hard.fyi/api/live?id=adobe-commerce-magento-file-upload-cve-2026-48356"}