Live › vulnerability › CVE-2026-48356
Go to dashboardAdobe Commerce and Magento accept uploaded files of dangerous types without restriction. An attacker who uploads such a file can run arbitrary code as the current user and may gain elevated access or control over a victim's account or session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 20:02 UTC, 0h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sites running Adobe Commerce or Magento in the listed version ranges, including Commerce B2B, are in scope. The sources do not say which configurations or upload features are required, so the exposure of any given store is unknown. CISA directs each owner to evaluate internet exposure of their assets.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Commerce and Magento | vendor | – | – |
| adobe commerce | vendor | = 2.4.4 | – |
| adobe commerce | vendor | = 2.4.5 | – |
| adobe commerce | vendor | = 2.4.6 | – |
| adobe commerce | vendor | = 2.4.7 | – |
| adobe commerce | vendor | = 2.4.8 | – |
| adobe commerce | vendor | = 2.4.9 | – |
| adobe commerce b2b | vendor | = 1.3.3 | – |
| adobe commerce b2b | vendor | = 1.3.4 | – |
| adobe commerce b2b | vendor | = 1.4.2 | – |
| adobe commerce b2b | vendor | = 1.5.2 | – |
| adobe commerce b2b | vendor | = 1.5.3 | – |
| adobe magento | vendor | = 2.4.6 | – |
| adobe magento | vendor | = 2.4.7 | – |
| adobe magento | vendor | = 2.4.8 | – |
| adobe magento | vendor | = 2.4.9 | – |
| adobe i\/o events | vendor | >= 1.6.0, < 1.21.0 | 1.21.0 |
bin/magento --versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-48356")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.