CVE-2026-48356: adobe commerce, adobe commerce_b2b, adobe magento

CVSS 9.3 (critical) · listed as exploited by CISA since 2026-10-27 · published 2026-07-14

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Affected products (NVD): adobe commerce, adobe commerce_b2b, adobe magento, adobe i\/o_events

Fixed in (NVD): 1.21.0

Weakness: CWE-434

Source: NVD CVE-2026-48356

References

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise
• https://sansec.io/research/polyshell-mass-attack-wave
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.