CISA lists Adobe Commerce file-upload flaw as exploited, fix due 10 November

CISA lists Adobe Commerce file-upload flaw as exploited, fix due 10 November

27 October 2026: The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356, an unrestricted file-upload flaw in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalogue on 27 October. Adobe rates it 9.3, critical, and its fix is in bulletin APSB26-73; NVD first published the flaw in July. Federal civilian agencies now have until 10 November 2026 to apply the fix or stop using the product.

Not yet independently verified. Adobe's bulletin APSB26-73 refused our requests (403) from three networks, so the fixed versions are not given here; the affected range comes from NVD. We have not read the Sansec research NVD cites, so we do not say who is exploiting the flaw. We will update this when it can be confirmed, and remove this note.

A KEV listing is CISA's statement that it has evidence of exploitation in the wild. CISA marks the use of this flaw in ransomware campaigns as unknown.

How the flaw is used

CISA describes it as an "unrestricted upload of file with dangerous type" (CWE-434) that could lead to arbitrary code execution in the context of the current user, and potentially to elevated access or control over the victim's account or session. NVD's record, using Adobe's own scoring, adds two conditions that shape the risk. Exploitation needs user interaction, such as a victim visiting a crafted URL or using a compromised page, and the scope is changed, so the impact can reach beyond the vulnerable component.

That combination points at shop administrators rather than anonymous scanning: an attacker who gets an admin to open a crafted link can plant a file on the store.

Versions in scope

NVD was first published on 14 July 2026 and last updated on 27 October. Its configuration lists Adobe Commerce from the 2.4.4 patch levels through 2.4.9, and Magento Open Source 2.4.x, in 171 product entries. Adobe's bulletin gives the fixed patch levels for each line, and merchants should take them from there, or from Adobe's Commerce release notes, rather than from a third-party summary.

This is a different flaw from the BlockStrap file-upload bug in Adobe Commerce, CVE-2026-103849, which Adobe fixed in bulletin APSB26-153.

What store owners should check

A shop that has applied the APSB26-73 update for its line should already be protected; the KEV listing is a reason to confirm it rather than assume it. Merchants on Magento Open Source with an agency or hosting partner should ask for the installed patch level in writing.

Because the flaw has been exploited for an unknown period, patching alone is not enough. Check the media and upload directories for unexpected PHP or script files, review admin accounts and recent logins, and compare checkout templates against a clean copy for injected JavaScript. Our catalogue lists 282 ecommerce development companies, many of which maintain Magento stores for clients.

Sources

• CISA: Known Exploited Vulnerabilities catalogue (JSON feed, release of 27 October 2026), 27 October 2026
• NIST NVD: CVE-2026-48356, 27 October 2026