← Vulnerability feed

Vulnerability record · CVE-2026-48356 · published 14 July 2026

CVE-2026-48356: Adobe commerce unrestricted file upload vulnerability

Adobe · Commerce

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

9.3 CVSS 3.1 Critical CISA KEV since 27 Oct 2026 EPSS 47% · top 1.1% CWE-434 · Unrestricted file upload
9.3CVSS 3.1 base score
47%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
4Affected product versions listed by NVD
4References
28 Oct 2026Last modified by NVD

Description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Exploitation in the wild

CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog on 27 October 2026 as "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 10 November 2026.

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://helpx.adobe.com/security/products/magento/apsb26-73.html Vendor Advisory
https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise Third Party Advisory
https://sansec.io/research/polyshell-mass-attack-wave Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356 US Government Resource

Track CVE-2026-48356 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-75650Adobe Commerce template engine flaw allows unauthenticated remote code executionAdobe Commerce, Commerce B2B and Magento are affected by improper neutralization of special elements used in a template engine (CWE-1336), allowing a…KEVEPSS 99%analysed9.8CVE-2024-34102Adobe Commerce and Magento XXE flaw allows unauthenticated code executionAdobe Commerce and Magento Open Source are affected by an improper restriction of XML external entity reference (XXE) vulnerability. A crafted XML do…KEVEPSS 100%analysed9.8CVE-2022-24086Adobe Commerce and Magento improper input validation in checkout enables RCEAdobe Commerce (2.4.3-p1 and earlier, 2.3.7-p2 and earlier) and Magento Open Source fail to properly validate input during the checkout process. The …KEVEPSS 99%analysed9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 92%9.1CVE-2025-54236Adobe Commerce improper input validation enables session takeoverAdobe Commerce and Magento are affected by improper input validation (CWE-20) across multiple 2.4.x branches and earlier. A remote, unauthenticated a…KEVEPSS 96%analysed9.8CVE-2026-92909Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current us…EPSS 0.79%9.8CVE-2024-45115Adobe commerce improper authentication vulnerabilityAdobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could resul…EPSS 1.3%9.8CVE-2024-34107Adobe commerce improper access control vulnerabilityAdobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2026-48356), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.