Adobe Commerce and Magento CVE-2026-48356 added to CISA KEV

CISA added the Adobe Commerce and Magento vulnerability CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026, which confirms exploitation in the wild. The flaw is an unrestricted file upload rated CVSS 9.3 (critical), and US federal agencies must act by 10 November 2026, according to the CISA KEV entry.

What happened

CISA lists the issue as an Adobe Commerce and Magento “Unrestricted Upload of File with Dangerous Type” vulnerability (CWE-434). The NVD record, published on 14 July 2026, says a successful attack could lead to arbitrary code execution in the context of the current user. That could give an attacker elevated access to, or control of, the victim’s account or session.

Exploitation needs user interaction: a victim must visit a maliciously crafted URL or interact with a compromised web page. NVD also notes that the scope is changed, meaning the impact can reach beyond the vulnerable component itself.

CISA has not said whether the flaw is used in ransomware campaigns; the KEV entry lists that as unknown. The NVD references also point to research from Sansec on a mass attack wave and on indicators of compromise, but this article does not rely on their contents.

Am I affected?

NVD lists these products and versions as affected:

• Adobe Commerce 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 and 2.4.9
• Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3
• Adobe Magento 2.4.6, 2.4.7 and 2.4.8
• Adobe I/O Events from 1.6.0 up to, but not including, 1.21.0

NVD records a fixed version only for Adobe I/O Events: 1.21.0. For the Commerce, B2B and Magento releases above, a fixed version has not been published in NVD. Adobe’s advisory is APSB26-73; check it for the patch or mitigation that applies to your exact release.

Technical details

• CVSS: 9.3 critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. That means network reachable, low complexity, no privileges, user interaction required, changed scope, high confidentiality and integrity impact, no availability impact.
• Weakness: CWE-434, unrestricted upload of a file with a dangerous type.
• KEV status: added 27 October 2026, due date 10 November 2026.
• EPSS: 0.31, an estimated 31% probability of exploitation activity in the next 30 days.
• Required action from CISA: apply mitigations per vendor instructions, follow BOD 26-04 guidance and the “Forensics Triage Requirements”, or stop using the product if mitigations are unavailable.

Why this matters

Analysis, not new facts. Online stores are a high-value target because they handle customer sessions and payment flows. A file upload flaw that leads to code execution is a common stepping stone to web shells and skimmers. The user-interaction requirement lowers the odds of fully automated attacks, but it does not help much when admins or customers can be lured with a crafted link. Because the flaw is in KEV, treat patching or mitigation as a same-day task for internet-facing stores rather than something for the next maintenance window.

What to do

1. Inventory every Adobe Commerce, Magento, Commerce B2B and Adobe I/O Events deployment, including staging and forgotten test stores.
2. Read Adobe’s APSB26-73 and apply the listed patch or mitigation. Upgrade Adobe I/O Events to 1.21.0 or later.
3. If no mitigation is available for your release, follow CISA’s instruction and discontinue use of the affected component until one is.
4. Record the date you applied the fix. CISA’s deadline for federal agencies is 10 November 2026; other organisations should aim to be well ahead of it.

Detection and hunting ideas

No indicators of compromise have been published, so these ideas follow from the vulnerability type rather than from observed attacks:

• Review web server and application logs for uploads of unexpected file types, especially executable or script extensions, since your last known-good update.
• Search upload and media directories for files that were created recently and do not belong to your deployment.
• Check admin accounts, sessions and API tokens for unfamiliar activity, because the flaw can expose account or session control.
• Compare store code and templates against version control to spot injected scripts.
• If you find signs of compromise, rotate credentials and secrets, and follow your incident process. CISA also points to its forensics triage requirements.

What we do not know yet

CISA has not published who is exploiting the flaw, how many stores are affected, or the attack chain used. A fixed Commerce or Magento build has not been published in NVD. We will update this article if CISA, Adobe or researchers add details.

Related coverage

• Adobe Commerce BlockStrap RCE flaw patched (CVE-2026-103849)
• Plex Media Server flaw exploited, added to CISA KEV (CVE-2026-96656)
• Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2026-48356
• NVD: CVE-2026-48356
• Adobe security bulletin APSB26-73