Critical 9.6Being exploited
Adobe · Adobe Commerce and Magento Open Source · CVE-2026-48356
Adobe Commerce and Magento file upload flaw added to CISA's exploited list
A critical flaw in Adobe Commerce and Magento lets an attacker upload a dangerous file type and run code, with no login needed, though a user has to take an action for it to work. Adobe fixed it in July (bulletin APSB26-73) and said then it knew of no attacks. CISA added it to its Known Exploited Vulnerabilities list on 27 October, which means it is now being attacked.
- Affected
- Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier. Adobe's bulletin lists the July fixes for Magento Open Source 2.4.6 to 2.4.9 too.
- What to do
- Install the July 2026 patch for your branch from Adobe's bulletin: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul (also 2.4.5 and 2.4.4 for Adobe Commerce). If you are already patched, check the store for unexpected uploaded files and new admin users. CISA's due date for US agencies is 10 November.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Newly confirmed exploited (CISA KEV, 27 October) and critical, in a platform behind many online shops.