CVE-2026-48356criticalexploração observadaCWE-434

CVE-2026-48356: falha crítica em Adobe Commerce

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Adobe Commerce+ Monitorar Magento

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

82Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck, tem alerta oficial do governo brasileiro e tem prova de conceito pública.

ssvc Actcvss 9.3epss 47%
da publicação à arma74 dias
Publicada no NVD14 de jul.
1ª PoC+74d
VulnCheck+102d
Alerta oficial no Brasil

O governo federal publicou alerta, recomendação ou boletim que cita esta vulnerabilidade.

  • CTIR Gov · ALERTA 101/2026 · 28 out 2026Vulnerabilidade crítica no Commerce e Magento - Adobeler no gov.br ↗
Fonte: CTIR Gov (GSI) e CISC Gov.br, sob licença CC BY-ND 3.0.
Ação exigida pela CISAprazo federal: 2026-11-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
Adobe · Adobe CommerceAdobe · Adobe Commerce B2BAdobe · Adobe Commerce EventsAdobe · Magento Open Source
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Adobe Commerce

No mesmo produto, das mais perigosas para as menos.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 95.4%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 90.5%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 3.9%KEVCVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 21.4%CVE-2025-24434CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 17.2%