{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:29.876Z","products":["adobe"],"actNowTotal":3,"results":[{"query":"adobe","matched":3,"actNow":3,"events":[{"id":"kev-2026-10-27-adobe-commerce-and-magento","url":"https://securitythreatpulse.com/events/kev-2026-10-27-adobe-commerce-and-magento","title":"Adobe Commerce and Magento: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 119 days old, so many systems are likely still unpatched. The severity score is critical (9.3).","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 15 days old.","5 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-48356"],"vendor":"Adobe","product":"Commerce and Magento","affectedProducts":[{"kind":"direct","slug":"adobe/commerceandmagento","vendor":"Adobe","product":"Commerce and Magento","evidence":["kev"],"vendorKey":"adobe","productKey":"commerceandmagento"},{"kind":"direct","slug":"adobe/adobecommerce","vendor":"Adobe","product":"Adobe Commerce","evidence":["cpe"],"vendorKey":"adobe","productKey":"adobecommerce"},{"kind":"direct","slug":"adobe/adobecommerceb2b","vendor":"Adobe","product":"Adobe Commerce B2b","evidence":["cpe"],"vendorKey":"adobe","productKey":"adobecommerceb2b"},{"kind":"direct","slug":"adobe/magentoopensource","vendor":"Adobe","product":"Magento Open Source","evidence":["cpe"],"vendorKey":"adobe","productKey":"magentoopensource"},{"kind":"direct","slug":"adobe/adobecommerceevents","vendor":"Adobe","product":"Adobe Commerce Events","evidence":["cpe"],"vendorKey":"adobe","productKey":"adobecommerceevents"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.","cvss":9.3,"epss":0.47472,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-27","kevDueDate":"2026-11-10","firstSeenAt":"2026-10-27T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-09T18:08:20.030Z"},{"id":"kev-2026-09-24-adobe-commerce-and-magento","url":"https://securitythreatpulse.com/events/kev-2026-09-24-adobe-commerce-and-magento","title":"Adobe Commerce and Magento: attackers can gain admin rights","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 91 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.1). The exploit prediction score is 92%.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","4 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-71362"],"vendor":"Adobe","product":"Commerce and Magento ","affectedProducts":[{"kind":"direct","slug":"adobe/commerceandmagento","vendor":"Adobe","product":"Commerce and Magento","evidence":["kev"],"vendorKey":"adobe","productKey":"commerceandmagento"},{"kind":"direct","slug":"adobe/adobecommerce","vendor":"Adobe","product":"Adobe Commerce","evidence":["cpe"],"vendorKey":"adobe","productKey":"adobecommerce"},{"kind":"direct","slug":"adobe/adobecommerceb2b","vendor":"Adobe","product":"Adobe Commerce B2b","evidence":["cpe"],"vendorKey":"adobe","productKey":"adobecommerceb2b"},{"kind":"direct","slug":"adobe/magentoopensource","vendor":"Adobe","product":"Magento Open Source","evidence":["cpe"],"vendorKey":"adobe","productKey":"magentoopensource"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.","cvss":9.1,"epss":0.91677,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-24","kevDueDate":"2026-09-27","firstSeenAt":"2026-09-24T00:00:00.000Z","updatedAt":"2026-11-10T18:00:06.591Z","newestEvidenceAt":"2026-10-25T01:02:39.879Z"},{"id":"kev-2026-09-08-adobe-commerce-and-magento","url":"https://securitythreatpulse.com/events/kev-2026-09-08-adobe-commerce-and-magento","title":"Adobe Commerce and Magento: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 61 days old, so current versions are being attacked. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 99%.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-75650"],"vendor":"Adobe","product":"Commerce and Magento","affectedProducts":[{"vendorKey":"adobe","productKey":"commerceandmagento","vendor":"Adobe","product":"Commerce and Magento","slug":"adobe/commerceandmagento","kind":"direct","evidence":["kev"]}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","cvss":10,"epss":0.99376,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-08","kevDueDate":"2026-09-11","firstSeenAt":"2026-09-08T00:00:00.000Z","updatedAt":"2026-11-07T23:37:40.191Z","newestEvidenceAt":"2026-11-05T15:30:06.518Z"}]}]}