CVE-2026-48356 lets dangerous file types be uploaded in Adobe Commerce and Magento. CISA lists it as actively exploited. Affected versions and fixes.
A critical flaw affects stores running Adobe Commerce and Magento: CVE-2026-48356 (CVE is the shared identifier for a published vulnerability). The flaw comes from the upload feature not checking dangerous file types closely enough. Adobe published it in July 2026. CISA added it to its catalog of actively exploited vulnerabilities at the end of October.
Short answer: CVE-2026-48356 is a critical flaw in Adobe Commerce and Magento Open Source that allows dangerous file types to be uploaded (CWE-434). NVD scores it 9.3 (CVSS), and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog. No authentication is required, but exploitation needs a user to visit a malicious page or interact with a compromised one. Adobe has not published a workaround, so the only documented fix is to upgrade to a July 2026 fixed release.
What happened?
The weakness is CWE-434, “Unrestricted Upload of File with Dangerous Type.” If the application does not check what an uploaded file really is, a file that the server can run may be left behind. According to the NVD description, this can lead to code execution in the context of the current user, and it may let an attacker gain elevated access or take control of the victim’s account or session.
The flaw is old, but its use in attacks was confirmed recently. The CVE was published on July 14, 2026. CISA added it to KEV on October 27, 2026. CISA marks its use in ransomware campaigns as “Unknown,” so there is no verified information on that point.
Who is affected?
| Attribute | Details |
|---|---|
| CVE | CVE-2026-48356 |
| Affected products | Adobe Commerce, Magento Open Source |
| Affected versions | Adobe Commerce: 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier; 2.4.5-p17 and earlier; 2.4.4-p18 and earlier. Magento Open Source: 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier |
| Fixed versions | Adobe Commerce: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul. Magento Open Source: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul |
| CVSS | 9.3, critical (NVD). The Adobe bulletin lists the same flaw at 9.6 |
| Weakness type | CWE-434 |
| Authentication | Not required (Adobe bulletin) |
| NVD published | July 14, 2026 |
| Added to CISA KEV | October 27, 2026 |
| CISA due date | November 10, 2026 |
| Adobe bulletin | APSB26-73, priority 2 |
This article does not cover older versions that are not in the table. The Adobe bulletin also lists Adobe Commerce B2B and Adobe Commerce Events; check the relevant table in the bulletin for their versions.
What should you do?
- Find your version. Run
bin/magento --versionin the store’s root directory. - If your version falls in one of the affected ranges above, upgrade to the July 2026 fixed release from Adobe. Take a full backup of your files and database before upgrading.
- If you cannot upgrade, note that the Adobe bulletin gives no workaround. The CISA KEV entry says that if mitigations are unavailable, the product should be discontinued. That may not be realistic for every store, but it shows how serious the risk is.
- Check your upload directories. Look for unexpected, executable files, especially under
pub/media. - Review your administrator accounts. If you see an account you do not recognize, copy the logs before changing anything on the server.
- If you are unsure, do not wait. Talk to a security specialist, and keep the server logs and file list so you can work out later what happened.
Frequently asked questions
Does this affect me?
Yes, if your version falls in one of the affected ranges in the table. Start with bin/magento --version. This article does not cover versions missing from the table, so check the Adobe bulletin for those.
The CVSS score is 9.3 in NVD but 9.6 in Adobe’s bulletin. Which one is right?
The two sources differ, but both rate the flaw critical. What matters more is that CISA lists it in KEV, which means exploitation is confirmed. The difference in score does not change the decision to upgrade.
What if I cannot upgrade right away?
Adobe has not published a workaround, so keep the waiting period short. Make an upgrade plan today, take a backup, and check your upload directories. If you see a suspicious file during this time, get help.
Sources
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-48356
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Adobe security bulletin APSB26-73: https://www.adobe.com/trust/security/products/commerce/apsb26-73.html
This article was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information appears. If you want help with updates and security maintenance for your store, you can reach me through the quote form.