Adobe Commerce and Magento: CVE-2026-48356 exploited (CISA KEV)

On 27 October 2026 CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog, which lists the vulnerabilities for which the US agency has evidence of active exploitation. The entry is titled “Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability”.

The CVE is not new: the National Vulnerability Database (NVD) published it on 14 July 2026, more than three months before it was added to the KEV. The NVD record was last modified on 27 October, the same day as the KEV addition. This article is based only on the KEV entry and the NVD record: the available sources do not describe the attacks, the victims or the threat actors.

What CISA and NVD say

• CVE: CVE-2026-48356, weakness CWE-434 (unrestricted upload of file with dangerous type).
• Severity: CVSS 3.1 9.3 (critical), the same score assigned by Adobe and by NVD.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. This means: network attack, low complexity, no privileges required, but user interaction is required; scope changed; high impact on confidentiality and integrity, no impact on availability.
• Effect: according to the NVD description, the vulnerability can lead to arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.
• Exploitation condition: again according to NVD, the victim must visit a maliciously crafted URL or interact with a compromised web page.
• Ransomware: the KEV field on known use in ransomware campaigns reads “Unknown”.

The sources do not describe the attack chain, the techniques used or when exploitation began.

Affected products and versions

The configuration in the NVD record lists:

• Adobe Commerce 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 and 2.4.9;
• Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3;
• Magento 2.4.6, 2.4.7, 2.4.8 and 2.4.9;
• Adobe I/O Events from 1.6.0 up to, but not including, 1.21.0.

The vendor reference listed by NVD is Adobe security bulletin APSB26-73. Check the bulletin for the exact list of affected versions, including patch levels, and for the fixed versions.

Among its references NVD also links two research pages by Sansec, a company specialising in e-commerce security: polyshell-mass-attack-wave and magento-cms-block-loader-deepveindrilling, the latter with a section on indicators of compromise. We have not analysed them for this article and do not report their content, but anyone running a store on Adobe Commerce or Magento should read them.

What CISA asks

The KEV entry asks organisations to:

• apply mitigations according to the vendor’s instructions, following CISA’s BOD 26-04 directive on prioritising security updates based on risk and its forensic triage requirements (“Forensics Triage Requirements”);
• for cloud services, follow the same directive or discontinue use of the product if mitigations are unavailable;
• assess the internet exposure of every asset.

The deadline for US federal agencies is 10 November 2026. It does not apply to European companies, but it shows the priority CISA gives to the vulnerability.

Impact for European and Italian companies

Adobe Commerce and Magento are e-commerce platforms used by many online stores, in Italy too, often managed by agencies or external hosting providers. An exploited vulnerability that allows code execution and control of a user’s session directly affects customer and order data.

If an attack leads to a personal data breach, GDPR obligations apply, including notification to the supervisory authority within 72 hours when there is a risk to individuals. Online marketplaces are among the digital providers covered by NIS2: for them, handling exploited vulnerabilities is part of the required security measures, and any significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Take an inventory of your Adobe Commerce, Adobe Commerce B2B and Magento installations, including test instances and those managed by agencies or providers, with exact versions. Also check whether Adobe I/O Events is installed and which version.
2. Read bulletin APSB26-73 and apply the updates or mitigations Adobe indicates. The CVE has been public since 14 July: if you have not yet applied the bulletin’s fixes, this is top priority.
3. Carry out forensic triage, as CISA also asks: an update does not remove anything an attacker may already have left on the server. In particular, check:
   • new or modified files in the folders where the store saves uploaded files and in the rest of the site directory, especially executable files such as PHP scripts;
   • recently created or modified admin accounts and unusual sessions;
   • unusual requests in the web server logs.
4. Compare your systems with the indicators of compromise published by Sansec and referenced in the NVD record.
5. Reduce exposure: restrict access to the admin panel and, together with your provider, decide how to protect the store if you cannot update right away.
6. If you find traces: isolate the server, change the credentials and secrets stored on it, then assess your notification obligations.

How ARXDOME helps

ARX Expose shows your company’s internet-facing services and the products it recognises, useful for finding exposed online stores. ARX Shield lists open vulnerabilities on machines with the agent, highlighting those already exploited, and lets you isolate a suspicious machine from the network. ARX Sentry checks file integrity in the folders you choose: if you include the store’s folders, new files appearing there become an event to analyse.

Last updated: 27 October 2026