Adobe Commerce and Magento APSB26-73 fixes exploited file upload and other vulnerabilities (CVE-2026-48356)

What happened

CVE-2026-48356 is an unrestricted file upload (CWE-434) flaw in Adobe Commerce. An attacker can use it to execute code in the context of the current user, potentially gaining elevated access or control of the victim's account or session. Exploitation requires user interaction: the victim must visit a maliciously crafted URL or interact with a compromised web page. The CVSS 3.1 score is 9.3 (critical), and scope is changed.

CISA has listed CVE-2026-48356 in the Known Exploited Vulnerabilities catalog, and CISA SSVC records exploitation as active. Adobe has not published its own statement on exploitation.

The APSB26-73 bulletin also covers CVE-2026-48358 (improper encoding or escaping), CVE-2026-47994 and CVE-2026-47995 (stored cross-site scripting), CVE-2026-47988, CVE-2026-47984, CVE-2026-47996 and CVE-2026-47997 (incorrect authorization), CVE-2026-47992 (SQL injection), and CVE-2026-48000 (open redirect). These other CVEs are not listed in CISA KEV.

Who is affected

Affected versions are Adobe Commerce up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18; Adobe Commerce B2B up to and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18; Magento Open Source up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15; and Adobe Commerce Events up to and including 1.20.0. Operators should verify whether their version is among these. Fixed versions are listed below.

What to do now

1. Apply the fixed releases from Adobe: Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul and 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul and 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul; and Adobe Commerce Events 1.21.0.
2. Prioritise CVE-2026-48356. CISA's KEV due date is 10 November 2026. CISA's required action is to apply vendor mitigations, follow BOD 26-04 guidance, and discontinue use of the product if mitigations are unavailable.
3. Review the Sansec indicators of compromise in the references to check for signs of earlier exploitation. No workaround has been published in the advisory.

How to detect it

Adobe's advisory does not list indicators of compromise. The references include Sansec research pages with indicators of compromise for Magento CMS block loader activity; security teams can use those to check for related exploitation. Because CISA KEV records active exploitation, treat CVE-2026-48356 as a priority for detection.

Beyond the patch

Beyond patching, the active exploitation listed by CISA for CVE-2026-48356 makes detection and response the first line. Our Managed Detection & Response (MDR) and Incident Response Retainer support that. For the incorrect authorization flaws in this bulletin that are reachable over the network without credentials, Virtual CISO Services (vCISO) can help identify exposed services or open ports before they are exploited.