Adobe Commerce and Magento Flaw CVE-2026-48356 Is Now Exploited, CISA Says: Install the July 2026 Patch

TL;DR: CISA added CVE-2026-48356, a file upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on October 27, 2026, saying there is evidence of active exploitation. Adobe fixed it in its July 14, 2026 security update, APSB26-73, and rates it Critical with a CVSS score of 9.6. If you run an online store on Commerce or Magento and haven’t installed the July 2026 patches (versions ending in -2026-jul), do it now and check the store for signs of tampering.

What happened

On October 27, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog “based on evidence of active exploitation.” The catalog describes it as an “unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user.” CISA gives federal civilian agencies until November 10, 2026 to fix it. It doesn’t say who was attacked or whether ransomware is involved (it lists ransomware use as “Unknown”). The same CISA alert added the Brotli flaw CVE-2026-111497, which we cover in our Node.js story.

Adobe fixed the flaw on July 14, 2026, in security bulletin APSB26-73, alongside 13 other Commerce issues. Adobe rates CVE-2026-48356 Critical, with a CVSS 3.1 base score of 9.6, and says it needs no authentication, but a user must take an action (Adobe’s score assumes user interaction, and the CVE record says a victim must visit a maliciously crafted URL); it lists the impact as privilege escalation, while CISA’s catalog describes code execution. The CVE record, filed by Adobe, gives a score of 9.3. When it published the bulletin, Adobe said it “is not aware of any exploits in the wild for any of the issues addressed in these updates,” and that line was unchanged at our check.

Why it matters

Online stores are a favorite target because they handle payment details. A flaw that lets an attacker upload a dangerous file can let them plant code on the server, for example to skim card numbers at checkout. The patch has been out since July, so stores that skipped it have been exposed for over three months, and now attackers are using it, according to CISA.

What to do now

1. Check your version. Run bin/magento --version or look in the admin. If an agency or host runs your store, ask them.
2. Install the July 2026 update. Adobe’s fixed versions are 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, and for Adobe Commerce also 2.4.5-2026-jul and 2.4.4-2026-jul. Commerce B2B needs 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul. Adobe Commerce Events needs 1.21.0. Adobe recommends updating to the newest release.
3. Check for tampering. Our advice: look for unexpected files, especially PHP files, in pub/media and other writable folders, new admin accounts, and changes to checkout or payment templates. If you find any, bring in help and treat the store as compromised.
4. If you can’t update today, our advice is to put a web application firewall or your host’s protections in front of the store and limit file uploads until you can. That lowers the risk; it doesn’t fix the flaw.

Updates

• Oct 28, 2026, 7:15 a.m. Manila: First published. Adobe’s bulletin still says it isn’t aware of exploits; we’ll add a dated note if Adobe revises it.

Sources & method

Sources

• Adobe security bulletin APSB26-73, “Security update available for Adobe Commerce” (July 14, 2026; last updated Aug 11, 2026)
• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” Oct 27, 2026
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.27)
• CVE-2026-48356 record (CNA: Adobe)

Method. Checked October 28, 2026, at 7:15 a.m. Manila time (23:15 UTC on October 27). The affected and fixed versions, severity, CVSS 9.6 score, July 14 date and Adobe’s exploitation statement come from Adobe’s bulletin APSB26-73. The exploitation status, date added, November 10 deadline and CISA’s description come from CISA’s catalog (version 2026.10.27) and its October 27 alert. The 9.3 score comes from the CVE record. Steps labelled “our advice” are our own judgment, not Adobe’s. The thumbnail is the preview image from Adobe’s bulletin. No affiliate links on this page. How we work.