· CVE-2026-48356

Adobe Commerce / Magento Unrestricted file upload

9.3 CVSS · criticalExploited

Unrestricted file upload in Adobe Commerce / Magento. Exploitable over the network, without logging in, a user has to take part. CVSS 9.3 (critical). According to CISA it is already being exploited. The vendor names the fixed versions in its report.

Vendor security advisory

helpx.adobe.com · The vendor’s information prevails.

At a glance

CVE
CVE-2026-48356
Product
Adobe Commerce / Magento
Vendor
Adobe
Affected versions
  • ≤ 2.4.9
  • ≤ 2.4.8-p5
  • ≤ 2.4.7-p10
  • ≤ 2.4.6-p15
  • ≤ 2.4.5-p17
  • ≤ 2.4.4-p18
per the vendor or CVE issuer
Fixed in
see the vendor’s report
CVSS
9.3 (critical)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Known exploited
Yes, per CISA (in the KEV catalog since 27 October 2026)
Weakness type
CWE-434 (Unrestricted file upload)
Published
Last modified

What to do

  1. The fixed versions are listed in the vendor’s report. Update to the right version for your release line.
  2. Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
  3. Since it is already exploited: after updating, check whether the system was compromised before.
  4. Also check test, staging and forgotten installations of the same software.
Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Name at CISA: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Official references

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free