SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
8 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-48356 · CVSS 9.3

Adobe Commerce and Magento: attackers can run their own code

AFFECTSAdobe Commerce and MagentoAdobe CommerceAdobe Commerce B2bAdobe Magento Open SourceAdobe Commerce Events

OFFICIAL NAME: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

WHAT IT IS · WEBSITE OR ONLINE STOREIt runs public websites, online stores or the software behind them.

DO THIS FIRSTAsk whoever runs your website or store to update it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 119 days old, so many systems are likely still unpatched. The severity score is critical (9.3).

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The confirmation is 15 days old. 5 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    CVE-2026-48356 discussed publicly (CIRCL sighting). CVE-2026-48356 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. CISA Vulnrichment marks CVE-2026-48356 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-48356 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 105 days after disclosure. CISA listed it 105 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Nov 10, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. JUL 14, 2026
    CISA Vulnrichment marks CVE-2026-48356 as actively exploited
  2. SEP 25, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-48356
  3. OCT 26, 2026
    Magento Campaign Infects 953 Online Stores Across Five Domains
  4. Attack activity. OCT 26, 2026
    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
  5. OCT 27, 2026
    Public proof of concept for CVE-2026-48356 (CIRCL sighting) (2 reports, latest NOV 6)
  6. OCT 27, 2026
    CVE-2026-48356 discussed publicly (CIRCL sighting) (24 reports, latest NOV 9)
  7. OCT 27, 2026
    Adobe security advisory (AV26-697) – Update 1

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-48356 discussed publicly (CIRCL sighting), NOV 9
  2. [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-48356 (CIRCL sighting), NOV 6
  3. [3] Canadian Centre for Cyber Security: Adobe security advisory (AV26-697) – Update 1, OCT 27
  4. [4] CISA Known Exploited Vulnerabilities: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability, OCT 26
  5. [5] Security Affairs: Magento Campaign Infects 953 Online Stores Across Five Domains, OCT 26
  6. [6] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-48356, SEP 25
  7. [7] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-48356 as actively exploited, JUL 14
  8. [8] CIRCL Vulnerability-Lookup sightings: 24 more reports