On October 27, CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog. The flaw lets a dangerous file through an upload path in Adobe Commerce and Magento, with possible code execution under the current user’s context and subsequent access to an account or session. CISA lists a November 10 due date for federal remediation; other storefront operators have an exploited issue to prioritize against their own exposure and update schedule.
Adobe’s July security bulletin covers Adobe Commerce, Commerce B2B, Magento Open Source and Commerce Events, and gives updated releases for each. The bulletin, last updated in August, said, “Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.” CISA’s later KEV listing changes the operational priority. Inventory the release and branch running on each storefront.
October’s listing changes the timetable
Adobe rates the upload issue critical and says exploitation requires no credentials. Its bulletin assigns a 9.6 CVSS score. The Adobe-assigned CVE record describes an additional condition: a victim must visit a maliciously crafted URL or interact with a compromised web page. Its CVSS entry scores the issue 9.3 and marks user interaction required. Both sources identify dangerous-file upload and potential privilege escalation. Use the running build to decide which stores need the July update.
CISA’s catalog entry describes possible arbitrary code execution in the current user’s context and potential elevated access or control over a victim’s account or session. For this listing, it directs stakeholders to assess each asset’s internet exposure, follow Adobe’s mitigation instructions and its BOD 26-04 patching guidance, and use applicable forensic triage requirements.
A file reaches the wrong place
The published weakness is CWE-434, unrestricted upload of a file with a dangerous type. Prioritize exposed storefronts even if administrators use strong passwords: Adobe says the flaw requires no credentials, while its CVE record requires victim interaction.
Neither Adobe’s bulletin nor its CVE record gives a request signature for this flaw. Compare running releases to identify stores that need the update. For earlier activity, preserve storefront request, application and file-upload telemetry available in your deployment, and investigate suspicious entries with your incident team.
Match releases to Adobe updates
Adobe lists the following affected product branches and updated builds in APSB26-73. Check the running Commerce application and installed B2B and Events components where present. The ordinary base version can look current while the July security update suffix is missing.
| Product | Affected releases | Adobe’s updated releases |
|---|---|---|
| Adobe Commerce | 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier; 2.4.5-p17 and earlier; 2.4.4-p18 and earlier | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul |
| Adobe Commerce B2B | 1.5.3; 1.5.2-p5 and earlier; 1.4.2-p10 and earlier; 1.3.4-p17 and earlier; 1.3.3-p18 and earlier | 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul |
| Magento Open Source | 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul |
| Adobe Commerce Events | 1.6.0 through 1.20.0 | 1.21.0 |
These are the bulletin’s release-wide update targets; the bulletin covers several other flaws as well. Choose the appropriate branch’s July update from Adobe’s installation instructions and plan the change through normal storefront testing. Match each installed component to its own row; the Commerce core version does not identify the B2B or Events release.
Verify the deployed storefront builds
Check which Adobe Commerce and Magento storefronts are reachable from the internet. Record the running Commerce core version and the B2B and Events component versions on each affected store. Compare each value with its Adobe bulletin row, then patch affected product branches to the listed July releases. Prioritize public storefronts against CISA’s November 10 KEV date. For hosted services, follow the provider’s deployment process and CISA’s applicable guidance.
Verify the running component versions after deployment against the corresponding updated releases above. The expected result is the July-suffixed Commerce, B2B or Magento build on its branch, and Events 1.21.0 where installed. Keep earlier request and application evidence available for investigation if suspicious uploads or account activity surface; a successful update addresses the vulnerable release, while earlier activity needs its own investigation.