CVE-2026-48356: Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-10-27
EPSS: 44.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-28
Weakness: CWE-434

Description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Summary

CVE-2026-48356 is a critical (CVSS 9.3) unrestricted file upload flaw (CWE-434) in Adobe Commerce that can lead to arbitrary code execution in the context of the current user, potentially granting elevated access or control over a victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page, and the scope is changed. Affected products include Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Events, Adobe Magento, Adobe Magento Open Source, and Adobe I/O Events (fixed in 1.21.0). The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so apply vendor mitigations per CISA BOD 26-04 guidance, assess internet exposure, and discontinue use if mitigations are unavailable.

CVE-2026-48356 ثغرة حرجة (CVSS 9.3) من نوع رفع ملفات غير مقيّد بأنواع خطرة (CWE-434) في Adobe Commerce، وقد تؤدي إلى تنفيذ تعليمات برمجية عشوائية في سياق المستخدم الحالي، مما قد يمنح وصولاً مرتفعاً أو تحكماً في حساب الضحية أو جلستها. يتطلب الاستغلال تفاعل المستخدم، مثل زيارة رابط ضار مُصمم أو التفاعل مع صفحة ويب مخترقة، ونطاق التأثير متغيّر. تشمل المنتجات المتأثرة Adobe Commerce وAdobe Commerce B2B وAdobe Commerce Events وAdobe Magento وAdobe Magento Open Source وAdobe I/O Events (تم إصلاحها في 1.21.0). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، لذا طبّق إجراءات التخفيف وفق إرشادات CISA BOD 26-04، وقيّم مدى تعرض الأصول للإنترنت، وتوقف عن استخدام المنتج إذا لم تتوفر إجراءات تخفيف.

Affected products

Adobe Commerce: 2.4.4-p1, 2.4.4-p10, 2.4.4-p11, 2.4.4-p12, 2.4.4-p13, 2.4.4-p14 (+64); 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
Adobe Commerce: 1.3.3-p1, 1.3.3-p10, 1.3.3-p11, 1.3.3-p12, 1.3.3-p13, 1.3.3-p14 (+44); 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3
Adobe I/O Events: from 1.6.0 before 1.21.0 — fixed in 1.21.0
Adobe Magento: 2.4.6-p1, 2.4.6-p10, 2.4.6-p11, 2.4.6-p12, 2.4.6-p13, 2.4.6-p14 (+29); 2.4.6, 2.4.7, 2.4.8, 2.4.9
Adobe Commerce Events: through 1.20.0
Adobe Commerce: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
Adobe Commerce: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
Adobe Magento Open Source: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15

How to fix

Upgrade to a fixed version: Adobe I/O Events 1.21.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-48356 or the next vulnerability affects your stack