CVE-2026-48356 Exploited in the wild
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- Risk score
- 100/100
- CVSS
- 9.3 v3.1
- Exploit chance (30 days)
- 30.6%
- Published
- 14 Jul 2026
- Added to CISA's exploited list
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Adobe Commerce has an Unrestricted Upload of File with Dangerous Type vulnerability that allows arbitrary code execution, potentially gaining elevated access or control over the victim's account or session, via a maliciously crafted URL or compromised web page.
- Affected
- {'product': 'Adobe Commerce', 'vendor': 'Adobe'}
- Fix
- Apply mitigations in accordance with vendor instructions
- Exploitation
- Exploited in the wild
Story map
At a glance
Adobe Commerce And Magento: Red, act today. Adobe Commerce has an Unrestricted Upload of File with Dangerous Type vulnerability that allows arbitrary code execution, potentially gaining elevated access or control over the victim's account or session, via a maliciously crafted URL or compromised web page.
The flaws
- CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVSS 9.3 · EPSS 31% · exploited)
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVSS 9.1 · EPSS 88% · exploited)
- CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (exploited)
The fix
Fix: Apply mitigations in accordance with vendor instructions
Who is exposed: {'product': 'Adobe Commerce', 'vendor': 'Adobe'}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 8 Sep
- US federal deadline 11 Sep
How it unfolded
- 8 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (3 of these flaws)
- 11 Sep, Deadline (official): US federal agencies must have patched
- 27 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog
Connects to
- Same weakness: Unrestricted file upload (CWE-434). 117 other warnings in 30 days
Why it is Red
- CVSS 9.3 critical
- Exploitation likely: EPSS 30.6% (top 2%)
- Exploited in the wild (CISA KEV)
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Government and vendor bulletins
References
Original description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Last activity 27 Oct 2026. Patch Forecast updates every hour.