CISA Flags Critical Adobe Commerce Upload Flaw, Patch Now

CISA added CVE-2026-48356, a critical file-upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, after finding evidence the bug is being actively exploited. Federal civilian agencies now have until November 10, 2026 to patch or mitigate under CISA's Binding Operational Directive 26-04. The underlying flaw was originally fixed by Adobe back in July, in security bulletin APSB26-73 — which means any store still running an unpatched build has had an available fix sitting unapplied for more than three months.

What happened

On October 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog. CISA's catalog entry lists the vendor as Adobe, the product as "Commerce and Magento," and names the flaw an "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability." The catalog's required-action field directs agencies to apply mitigations in line with Adobe's instructions and CISA's Binding Operational Directive 26-04, with compliance due by November 10, 2026.

CISA's entry marks the known-ransomware-campaign-use field as "Unknown," and it does not describe how the flaw is being exploited, by whom, or against which targets. We did not find a CISA statement with those specifics, so readers should treat any detailed exploitation narrative circulating elsewhere as unverified unless it traces back to CISA or Adobe directly.

The vulnerability: an unrestricted file upload flaw

CVE-2026-48356 is classified under CWE-434, Unrestricted Upload of File with Dangerous Type, according to both the National Vulnerability Database (NVD) and CISA's KEV entry. In plain terms, this class of bug lets an attacker get a file onto the server that the application should have rejected — for example, a script disguised as an image — and then have that file executed. NVD's description, sourced from Adobe's own PSIRT team, states that successful exploitation "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session," and that exploitation requires user interaction: a victim has to visit a maliciously crafted URL or interact with a compromised web page.

The severity rating differs slightly depending on the source, which is worth being precise about. Adobe's own bulletin scores the flaw 9.6 (Critical) using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. NVD's published entry, which also credits Adobe's PSIRT as the scoring source, lists a slightly different vector — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N — that works out to a base score of 9.3 (Critical). The only variable that changed is the availability impact (Adobe's score assumes "Low," NVD's assumes "None"); either way, both agree the flaw requires no privileges to trigger, no authentication, and carries a high impact on confidentiality and integrity of the affected system. Both scores land solidly in the critical band.

Why the KEV listing matters

CISA only adds a vulnerability to the KEV catalog when it has evidence of active, in-the-wild exploitation — the catalog exists specifically to separate "theoretically dangerous" bugs from ones attackers are actually using. That distinction carries real operational weight for anyone running Adobe Commerce or Magento, for two reasons.

First, under Binding Operational Directive 26-04, every U.S. federal civilian executive branch agency running a vulnerable, internet-exposed instance of Adobe Commerce, Adobe Commerce B2B, or Magento Open Source has a hard deadline — November 10, 2026 — to patch, mitigate, or take the system offline. Second, and more broadly relevant to anyone outside government, a KEV listing is one of the clearest public signals that a flaw has moved from "patch when convenient" to "patch now." Retailers, marketplaces, and any business running a storefront on an affected Adobe Commerce or Magento build should treat this the same way federal agencies are required to.

It's also worth noting this isn't an isolated incident for the platform. CISA added a different Adobe Commerce flaw, CVE-2026-71362 — an incorrect-authorization bug — to the KEV catalog back on September 24, 2026, with its own patch deadline that has already passed. CVE-2026-48356 is a separate, unrelated vulnerability, patched in a different Adobe bulletin, but the back-to-back KEV listings underscore that Adobe Commerce and Magento storefronts remain an active target.

Timeline: from a quiet July patch to an active-exploitation warning

The gap between when a fix becomes available and when CISA confirms active exploitation is often the most important window in a vulnerability's life, and this case illustrates it clearly:

• July 14, 2026 — Adobe publishes security bulletin APSB26-73, patching 14 vulnerabilities in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Events, including CVE-2026-48356.
• August 11, 2026 — Adobe updates the bulletin (NVD's record reflects this as the bulletin's last-modified date).
• October 27, 2026 — CISA adds CVE-2026-48356 to the KEV catalog, citing evidence of active exploitation, and sets a federal remediation deadline of November 10, 2026. NVD's record for the CVE was also updated the same day to reflect its new KEV status.

That's roughly three and a half months between a fix being publicly available and CISA confirming the unpatched flaw is now being actively abused — a reminder that "patched months ago" and "no longer a risk" are not the same thing for sites that didn't apply the update.

Affected versions and fixes

Adobe's bulletin APSB26-73, originally published July 14, 2026 and last updated August 11, 2026, lists CVE-2026-48356 among fourteen vulnerabilities patched in that release. The affected and fixed version ranges for the file-upload flaw specifically are below.

If your site has been applying Adobe's quarterly and interim security patches on schedule since July, you are very likely already on a fixed build. If patching has lagged — a common situation for self-hosted Magento Open Source installs without a managed support contract — this is the moment to check, not after the federal deadline passes.

How file-upload flaws get exploited

CISA has not published technical exploitation details for CVE-2026-48356, and Adobe's bulletin does not go beyond the CWE classification and impact summary either, so we won't speculate about a specific attack chain here. What can be said generally, based on how CWE-434 vulnerabilities are typically abused, is that an unrestricted file upload flaw gives an attacker a path to drop a web shell or other malicious script on a server and then execute it with the privileges of the vulnerable application — a foothold that can be used to steal stored payment and customer data, deface a storefront, or pivot further into connected systems. That general risk pattern is the same one we described in our explainer on how supply-chain attacks work — a single vulnerable ecommerce platform component can expose every merchant running on top of it, and a compromised storefront can in turn be used to attack its own customers.

It's a dynamic we've also tracked on the server-infrastructure side: our coverage of the PHP2Shell attacks against unpatched PHP servers described a similar end goal — getting an executable script planted on a web-facing server — achieved through a different, PHP-runtime-level vulnerability rather than an application-level upload filter bypass. The attacker's objective in both cases is the same even though the entry point differs.

Not the first Adobe Commerce KEV listing this year

This is the second Adobe Commerce or Magento vulnerability CISA has flagged as actively exploited in roughly a month. We covered the earlier case — CVE-2026-71362, a critical incorrect-authorization flaw added to the KEV catalog on September 24, 2026 — in detail at the time. That bug and this one are unrelated technically, but together they paint a consistent picture: Adobe Commerce and Magento Open Source installations, particularly ones that fall behind on quarterly patches, continue to draw sustained attacker interest. Ecommerce platforms are an especially attractive target because a single successful compromise can expose large volumes of stored payment and customer data across every merchant running the vulnerable code.

Background: what Adobe Commerce and Magento are

Magento is the open-source ecommerce platform that Adobe acquired in 2018 and now also sells as the commercial "Adobe Commerce" product, according to its Wikipedia entry. Magento Open Source remains the free, self-hosted version that many small and mid-sized retailers run themselves, while Adobe Commerce (and its B2B module) is the licensed, more heavily supported edition typically used by larger merchants — both share the same underlying codebase, which is why a single vulnerability class, like this file-upload bug, tends to affect both lines at once.

That shared codebase is also why patch management on these platforms is unusually consequential. A storefront running Magento Open Source without a managed-hosting contract is entirely dependent on whoever administers it to track Adobe's quarterly security bulletins and apply the corresponding patch — there's no automatic-update mechanism pushing fixes the way a SaaS platform might. Adobe Commerce Cloud customers typically have more of this handled by their hosting provider, but it's still worth confirming directly rather than assuming.

What site owners should do next

If you operate, manage, or host a storefront on any affected version, treat this the way CISA is treating it for federal systems: as a now-not-later patch. Concretely:

• Verify your version and patch level against the table above using your admin panel or bin/magento --version on self-hosted installs.
• Apply the "-2026-jul" security patch (or a later cumulative patch that supersedes it) if you haven't already — Adobe's bulletin has been public since July, so this should not require waiting on a vendor timeline.
• Coordinate with your hosting provider or systems integrator if you're on a managed Adobe Commerce Cloud instance; confirm with them directly whether the fix has been applied on your behalf.
• Audit for signs of prior compromise — unexpected admin accounts, unfamiliar files in media or upload directories, and unexplained outbound connections from the web server are the kinds of indicators worth checking given CISA's confirmation of active exploitation.
• Don't assume a web application firewall is sufficient on its own — it can reduce exposure but is not a substitute for applying Adobe's actual fix.

CISA's KEV catalog entry for CVE-2026-48356 will remain the authoritative reference point for the federal deadline and any future updates to this listing; it's worth bookmarking if you're responsible for patch compliance at an organization that runs Adobe Commerce or Magento.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage