CVE-2026-48356criticalobserved exploitationCWE-434

CVE-2026-48356: critical vulnerability in Adobe Commerce

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Published · Updated

Follow this CVE+ Monitor Adobe Commerce+ Monitor Magento

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.3epss 45%
from disclosure to weapon74 days
Published on NVDJul 14
1st PoC+74d
VulnCheck+102d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 101/2026 · 28 Oct 2026Vulnerabilidade crítica no Commerce e Magento - Adoberead on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-11-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
Adobe · Adobe CommerceAdobe · Adobe Commerce B2BAdobe · Adobe Commerce EventsAdobe · Magento Open Source
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Commerce

In the same product, most dangerous first.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 95.4%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 90.5%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 3.9%KEVCVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 21.4%CVE-2025-24434CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 17.2%