Adobe Commerce and Magento: critical CVE-2026-48356

What it is and who is affectedCVE-2026-48356 is an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, classified as CW...

What it is and who is affected

CVE-2026-48356 is an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, classified as CWE-434. In plain terms, the platform can be persuaded to accept a file it should never have stored, and that file can then be used to run arbitrary code in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

The severity is critical: CVSS 3.1 base score 9.3, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Note the UI:R component: exploitation requires user interaction, in that a victim must visit a maliciously crafted URL or interact with a compromised web page. The scope is changed, so the impact can reach beyond the vulnerable component itself. The flaw was published in the NIST National Vulnerability Database on 14 July 2026.

The affected configurations listed by the NVD cover Adobe Commerce 2.4.4 and its patch levels p1 through p18, plus a further 159 configurations. If your shop runs a 2.4.4 branch of Adobe Commerce or Magento, assume you are in scope until you have checked precisely which build is deployed. This matters directly for online retailers in Barcelona, Lleida, Tarragona and Girona running catalogue-heavy stores with third-party modules, custom themes and a small IT team.

Why it is urgent

This is not a theoretical risk. CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026, which means there is evidence of exploitation in real attacks. CISA has given US federal agencies until 10 November 2026 to apply mitigations in line with the vendor's instructions, following its risk-based patching guidance and forensics triage requirements, and to assess each asset's internet exposure. There is no record in the material of use in ransomware campaigns, but active exploitation of an upload flaw on a commerce platform is serious enough on its own: a compromised admin session or a planted file can expose customer data, orders and payment-adjacent information, with GDPR notification obligations following close behind.

What to do today

Inventory first. Confirm whether Adobe Commerce or Magento is in use and pin the exact version, including the patch suffix. A 2.4.4 p9 install and a 2.4.4 p18 install are different risk profiles, and you cannot mitigate what you have not identified.
Apply the vendor advisory. Follow the guidance in Adobe's security bulletin apsb26-73 for the correct update or mitigation for your version. Where the advisory does not state a fixed release for your exact build, apply whatever the vendor instructs rather than guessing.
Hunt for indicators of compromise. Review the indicators published in the Sansec research notes referenced by the advisory, and inspect upload directories, recently modified files and unexpected administrative activity. Treat any unexplained file in a writable path as suspicious until proven otherwise.
Reduce internet exposure. Restrict access to administration panels and staging environments by IP or VPN, remove unused extensions, and make sure backups are recent, tested and stored offline — a clean restore is the fastest route out of a hacked storefront.

How a cybersecurity team can help

Most SMEs and online shops do not have the internal capacity to audit an e-commerce stack end to end while also running the business. That is where a specialist team fits in naturally. At ALMC we work with companies across Catalonia on exactly this: security audits and pentesting to find weaknesses before someone else does, server hardening, monitoring and incident response, and the ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations — the same discipline that keeps any CMS or commerce platform current. When a site has already been compromised, we also handle the cleanup and repair of hacked websites, tracing how the entry happened so it does not happen twice.

The lesson from CVE-2026-48356 is not that Adobe Commerce is uniquely fragile. It is that a single unpatched upload path on a revenue-generating platform can be turned into code execution, and that attackers move faster than quarterly maintenance cycles. Knowing your versions, watching the KEV catalogue and the NVD, and closing the gap between advisory and patch is the whole job.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.