CVE-2026-48356: Adobe Commerce and Magento unrestricted file upload exploited

# CVE-2026-48356: Adobe Commerce and Magento unrestricted file upload exploited

https://gcdradar.vercel.app/incidents/cve-2026-48356-adobe-commerce-and-magento-unrestricted-file · AIR-2026-1601 · closed 2026-11-10

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploitation in the wild is confirmed via CISA KEV.
- Fix status: Patched
- First reported: 2026-10-27
- AI role: No AI role
- Products: Adobe Commerce, Magento
- CVE ids: CVE-2026-48356
- CVSS: 9.6

## Summary

Adobe Commerce and Magento contain an unrestricted file upload vulnerability that allows arbitrary code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild.

## What to do

Apply mitigations and updates in accordance with vendor instructions.

## Affected and fixed versions

- Affected: Adobe Commerce
- Affected: Magento

## Latest updates

- 2026-10-27: CVE-2026-48356: Adobe Commerce and Magento — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356)

## Sources

- 2026-10-27 CISA: CVE-2026-48356: Adobe Commerce and Magento — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.