If your online store runs on Magento or Adobe Commerce, this one is worth ten minutes today. A critical flaw that Adobe fixed in July has now been added to the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities known to be exploited.
The short answer
CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026. CISA's entry calls it an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento. The due date for US federal agencies is 10 November 2026. Businesses outside the federal government are not bound by that date, but it is a useful signal of how seriously to treat it.
Adobe fixed the flaw in its July 2026 security update, bulletin APSB26-73, published on 14 July. If your store has applied that update, you are covered for this issue. If not, update first and investigate second.
What Adobe says about the flaw
From Adobe's bulletin:
- Severity: Critical, CVSS base score 9.6.
- Category: Unrestricted upload of a file with a dangerous type (CWE-434), with privilege escalation as the impact.
- Authentication: not required to exploit. The CVSS vector marks user interaction as required.
- Status at publication: Adobe said in July it was not aware of exploits in the wild. CISA's addition on 27 October changes that picture.
The same bulletin fixes a number of other flaws, including CVE-2026-48358 (CVSS 9.1, webhooks only, authentication required) and several stored cross-site scripting and authorization issues. So the update is worth applying even apart from this one CVE.
Which versions are affected
Adobe lists these as affected:
| Product | Affected versions | Updated version (example) |
|---|---|---|
| Adobe Commerce | 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier | 2.4.8-2026-jul |
| Magento Open Source | 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier | 2.4.7-2026-jul |
| Adobe Commerce B2B | 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier | 1.5.2-2026-jul |
Use the version table on Adobe's page for your exact line. Note that Magento Open Source 2.4.5 and earlier are not listed with an update.
What to do today
- Find out which version your store runs (admin panel footer, or
composer.json). - If it predates the
2026-julrelease for your line, schedule the update now, starting with a staging copy if you have one. - Ask your host or developer to confirm the update was applied, not just planned.
- Review your media and upload folders for files with unexpected types, such as scripts, that you did not add.
- Check that admin accounts are all people you recognise, and turn on two-factor sign-in for admins.
- Make a fresh backup before and after the update.
- If you suspect compromise, change admin and database passwords, rotate API keys and bring in a security professional.
If your store takes card payments, tell your payment provider or acquirer if you find signs of tampering, as they may have their own reporting rules.
Why this matters for small stores
Stores that run their own Magento install often fall behind on patches because updates need testing and a developer's time. A flaw that was fixed three months ago and is now being used in attacks is the typical shape of a real-world break-in: patches exist, but have not been applied.
If a monthly patch routine does not exist at your business, now is a good moment to set one up. We cover the broader picture in how to choose a software development company, including what ongoing maintenance should cost, and in Shopify vs custom ecommerce if a hosted platform that patches itself might suit you better. For another exploited flaw in a common web stack, see our note on the PHP2Shell flaws.
How we can help
At Susraj Tech we build and maintain ecommerce and web applications for businesses in India and the US. If you want a second pair of eyes on your store's patch status, see our website development service or contact us.
