CISA added CVE-2026-48356, a critical file-upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on October 27, 2026. Adobe fixed it in its July 14 security bulletin, APSB26-73. Any Magento store still missing the July patches should treat the update as urgent.

What’s new

  • Adobe rates the flaw critical, with a CVSS score of 9.6. It’s an unrestricted upload of a dangerous file type, and CISA’s entry says it could lead to arbitrary code execution and control of a victim’s account or session.
  • The CVSS vector in Adobe’s bulletin shows no login is needed, though the attack requires some user interaction.
  • Affected versions include Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Fixed builds carry the “2026-jul” label, such as 2.4.8-2026-jul.
  • Adobe’s bulletin, last updated August 11, said it wasn’t aware of exploits at that time. CISA’s listing is the first official confirmation of attacks, and federal agencies must patch by November 10.

Who it affects

This hits stores running Adobe Commerce or self-hosted Magento Open Source. Shopify, WooCommerce and BigCommerce stores aren’t affected by this CVE. Agencies that look after several Magento builds should check each one, since patch levels drift apart quickly across a client list.

Magento merchants have had a busy few months. Adobe also shipped an emergency fix in September for a separate flaw that The Hacker News reported was exploited as a zero-day, so a store that missed July may well have missed September too.

Our take

Check your exact version and confirm the July patches, and everything since, are installed. CISA confirmed attacks months after the fix came out, so a store that patched late could already have been hit, and patching alone isn’t enough. Look for unfamiliar PHP files in media and upload folders, admin users you didn’t create and edited checkout or email templates, then rotate admin passwords and API keys. If you’re stuck on an older release line, ask your developer whether staying on Magento still makes sense for the next year, or whether a move to another platform would cost less to run safely.

If your store needs a version check or a cleanup, our ecommerce development team works with ecommerce brands on patching, hardening and platform moves. Start with a free audit.