CVE entry · CVE-2026-48356
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
- Actively exploited: added to CISA’s KEV catalog on October 27, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 10, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Adobe Commerce and Magento, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Adobe vulnerabilities
-
Adobe Commerce and Magento Incorrect Authorization Vulnerability
-
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
-
Adobe ColdFusion Path Traversal Vulnerability
-
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
-
Adobe Acrobat and Reader Prototype Pollution Vulnerability
-
Adobe Acrobat Use-After-Free Vulnerability