English
English 日本語
Get a fix plan
Menu

Projects

Apache HTTP ServerApache Log4jnginxNode.jsOpenSSLPHPApache TomcatWordPressAll projectsStatusAlerts (soon)Method Get a fix plan
Data checked 26 open events tracked Official sources only

Adobe Commerce and Magento in CISA KEV: affected versions, updates, and the timeline

CISA added an Adobe Commerce and Magento flaw to its Known Exploited Vulnerabilities catalog. Adobe's bulletin for it was published earlier and says Adobe was not aware of exploits in the wild, so this page sets out what each source says, as printed, and the versions Adobe lists. Each statement below links to its official source, with the quoted text one click away. This page gives no exploitation details.

Facts last checked against the stored sources on

What happened

  • CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on , listing it under the name Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. The catalog lists as the due date.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-48356", "vendorProject": "Adobe", "product": "Commerce and Magento", "vulnerabilityName": "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability", "dateAdded": "2026-10-27",
    "dueDate": "2026-11-10",

  • The catalog describes CVE-2026-48356 as an unrestricted upload of a file with a dangerous type that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-48356",
    Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

  • For CVE-2026-48356, the catalog's field for known use in ransomware campaigns reads Unknown, and it does not mark forensic triage as required.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-48356",
    "knownRansomwareCampaignUse": "Unknown",
    "forensicTriage": "No",

  • Adobe's bulletin lists CVE-2026-48356 as Unrestricted Upload of File with Dangerous Type (CWE-434), with the vulnerability impact Privilege escalation, the severity Critical, and the answer No to whether authentication is required to exploit it.

    Source: Adobe security bulletin

    Quoted text
    CVE-2026-48356 Vulnerability category: Unrestricted Upload of File with Dangerous Type ( CWE-434 ) Vulnerability impact: Privilege escalation Severity: Critical Authentication required to exploit? No

  • Adobe gives CVE-2026-48356 a CVSS base score of 9.6, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L.

    Source: Adobe security bulletin

    Quoted text
    CVE-2026-48356 Vulnerability category
    CVSS base score: 9.6 CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

The bulletin and the later KEV listing

These statements come from two sources written at different times. This page reports each as printed and does not decide between them.

  • Adobe's bulletin APSB26-73 gives as the date published, and its page is marked as last updated on .

    Source: Adobe security bulletin

    Quoted text
    Last updated on Aug 11, 2026
    Bulletin ID Date published Priority APSB26-73 July 14, 2026 2

  • The bulletin says: Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

    Source: Adobe security bulletin

    Quoted text
    Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

  • CISA added CVE-2026-48356 to the catalog on , and the notes of that entry point to the same Adobe bulletin.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-48356",
    "dateAdded": "2026-10-27",
    "notes": "https://www.adobe.com/trust/security/products/commerce/apsb26-73.html ;

Affected and updated versions

These are the versions Adobe lists in its bulletin. Products and versions that are not listed here are not covered by this page.

  • For Adobe Commerce: Adobe lists the affected versions as 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier. The updated versions are 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul.

    Source: Adobe security bulletin

    Quoted text
    Adobe Commerce 2.4.9 2.4.8-p5 and earlier 2.4.7-p10 and earlier 2.4.6-p15 and earlier 2.4.5-p17 and earlier 2.4.4-p18 and earlier 2 All
    Adobe Commerce 2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul 2.4.5-2026-jul 2.4.4-2026-jul All 2

  • For Adobe Commerce B2B: Adobe lists the affected versions as 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier. The updated versions are 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul.

    Source: Adobe security bulletin

    Quoted text
    Adobe Commerce B2B 1.5.3 1.5.2-p5 and earlier 1.4.2-p10 and earlier 1.3.4-p17 and earlier 1.3.3-p18 and earlier 2 All
    Adobe Commerce B2B 1.5.3-2026-jul 1.5.2-2026-jul 1.4.2-2026-jul 1.3.4-2026-jul 1.3.3-2026-jul All 2

  • For Magento Open Source: Adobe lists the affected versions as 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier. The updated versions are 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul.

    Source: Adobe security bulletin

    Quoted text
    Magento Open Source 2.4.9 2.4.8-p5 and earlier 2.4.7-p10 and earlier 2.4.6-p15 and earlier 2 All
    Magento Open Source 2.4.9-2026-jul 2.4.8-2026-jul 2.4.7-2026-jul 2.4.6-2026-jul All 2

  • For Adobe Commerce Events: Adobe lists the affected versions as 1.6.0 to 1.20.0. The updated version is 1.21.0.

    Source: Adobe security bulletin

    Quoted text
    Adobe Commerce Events 1.6.0 to 1.20.0 2 All
    Adobe Commerce Events 1.21.0 All 2

  • Adobe says it categorizes these updates with priority ratings and recommends that users update their installation to the newest version.

    Source: Adobe security bulletin

    Quoted text
    Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

How to check and what to do

  • For CVE-2026-48356, CISA's required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 guidance, and to discontinue use of the product if mitigations are unavailable.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-48356",
    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance
    or discontinue use of the product if mitigations are unavailable.
  1. List every Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events installation you run, and note the version of each.
  2. Compare each version with the affected versions in the table above, and find the updated version for your version line in the same table.
  3. Update to the version Adobe lists for that line. Adobe recommends updating to the newest version.
  4. CISA's catalog entry asks for vendor mitigations to be applied by the due date shown above, and for use of the product to stop if mitigations are unavailable.
  5. Read the two statements in the timeline section as printed. The bulletin is the source for versions and updates, and the catalog entry is the source for CISA's listing and due date.