Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Read at CISA Known Exploited Vulnerabilities catalog
- Vendor
- Adobe
- Product
- Commerce and Magento
- EPSS
- 0.45 (p99)
- CISA KEV
- added 27 Oct 2026, due 10 Nov 2026 (9d)
- Exploitation
- observed in the wild
- Fix
- available
- Weakness
- CWE-434
- Exposure class
- Web platform
Why it ranks 80 (Critical)
- CISA KEV listed, remediation due 2026-11-10
- EPSS 0.45 (elevated)
- Product class: web platform
- Covered by 3 independent sources
- Fix available
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA Known Exploited Vulnerabilities catalog (nvd.nist.gov)
- Vendor advisory (adobe.com)
- CVE-2026-48356 on this site · NVD · CVE.org · Vulnpedia · KEV
Related coverage
Other items that share a CVE or were clustered with this one.