Adobe Commerce and Magento file upload flaw CVE-2026-48356 added to CISA's exploited list; July patches available
CISA says attackers are using CVE-2026-48356, a critical file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026. Store owners should apply the July patch for their version and check for files uploaded earlier, since patching doesn't remove them.
If you run an Adobe Commerce or Magento Open Source shop, apply the July 2026 patch for your version (or upgrade to the latest patch level first) and ask your developer to check for suspicious uploaded files. Shoppers have nothing to update.
What’s happening
CVE-2026-48356 is an unrestricted file upload flaw in Adobe Commerce, Commerce B2B and Magento Open Source, the software behind many online shops. Adobe fixed it on 14 July 2026 in bulletin APSB26-73 and rated it Critical, scoring it 9.6 (the public CVE and NVD records say 9.3). It needs no login but does need a user to take an action. CISA added it to its list of flaws used in attacks on 27 October 2026. Adobe's bulletin, last updated 11 August, still says it knows of no exploits in the wild, so the exploitation claim comes from CISA. Security firm Sansec says attempts began in March 2026, but Adobe and CISA haven't confirmed that. Adobe has released patches for every affected product line, as isolated patches that apply only to the newest patch level of each line. Patching doesn't remove files an attacker already uploaded. The advisory covers other flaws too, some also rated Critical. This mainly affects online shop operators, not ordinary shoppers.
- What
- Flaw
- Affects
- Adobe Commerce, Commerce B2B and Magento Open Source (online shop software)
- Affected
- Adobe Commerce 2.4.9; 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier
Adobe Commerce B2B 1.5.3; 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier
Magento Open Source 2.4.9; 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier
Adobe Commerce Events 1.6.0 to 1.20.0 - Fixed in
- Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
Adobe Commerce Events 1.21.0 - Since
- 27 Oct 2026
Timeline
- Wider attacks
Security firm Sansec, as relayed by Rescana, reports exploitation attempts from March 2026, a mass attack wave on 30 March, and a link to a script-loader campaign on 24 October. Adobe and CISA have not confirmed these details, and no indicators of compromise have been published.
- CISA added
CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities list, marking it as used in attacks. US federal agencies must fix it by 10 November 2026.
- Vendor revised
Adobe updated the bulletin. The page does not say what changed, and it still states that Adobe is not aware of exploits in the wild.
- Made publicFixed
Adobe published bulletin APSB26-73 for Adobe Commerce, Commerce B2B, Magento Open Source and Commerce Events. It fixed CVE-2026-48356, an unrestricted file upload rated Critical (CVSS 9.6), with July 2026 patches. Adobe said it knew of no exploits in the wild.
Sources
- APSB26-73 Security updates available for Adobe Commerce and Magento Open SourceAdobe · 11 Aug 2026
- Adobe Commerce and Magento CVE-2026-48356 file upload RCE added to CISA KEV, October 2026Rescana · 27 Oct 2026