Is CVE-2026-48356 exploited in the wild?

Yes. CVE-2026-48356 is known to be exploited in the wild, first recorded on 27 October 2026. Treat it as urgent.

How severe is CVE-2026-48356?

Critical severity, with a CVSS score of 9.6, published 14 July 2026.

Which products and versions are affected?

Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18; Adobe Commerce Webhooks Plugin <= 1.20.0; Adobe Commerce B2b <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18; Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.

Is there a fix for CVE-2026-48356?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48356 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48356?

Check whether you run Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48356: Adobe Commerce unrestricted file upload in multiple components

Q: Which products and versions are affected?

Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18; Adobe Commerce Webhooks Plugin <= 1.20.0; Adobe Commerce B2b <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18; Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.

Q: Is there a fix for CVE-2026-48356?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-48356 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-48356?

Check whether you run Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48356 · Severity: critical · CVSS 9.6 · Exploited in the wild · Published 2026-07-14

Adobe Commerce, a popular e-commerce platform used for online storefronts, is vulnerable to a critical security flaw that allows attackers to upload dangerous files. If exploited, an attacker could execute malicious code on the server or within a user's browser session, potentially leading to full account takeover or unauthorized access to customer data. This attack requires a victim to interact with a malicious link or a compromised web page.

Technologies: Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b, Adobe Magento, Adobe Magento Open Source. Vendors: Adobe.

Quick answers

Is CVE-2026-48356 exploited in the wild?: Yes. CVE-2026-48356 is known to be exploited in the wild, first recorded on 27 October 2026. Treat it as urgent.
How severe is CVE-2026-48356?: Critical severity, with a CVSS score of 9.6, published 14 July 2026.
Which products and versions are affected?: Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18; Adobe Commerce Webhooks Plugin <= 1.20.0; Adobe Commerce B2b <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18; Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.
Is there a fix for CVE-2026-48356?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48356 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48356?: Check whether you run Adobe Commerce, Adobe Commerce Webhooks Plugin, Adobe Commerce B2b or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) within Adobe Commerce and Magento Open Source. It allows a remote attacker to upload malicious files that can lead to arbitrary code execution. The attack vector is network-based and does not require administrative privileges, though it does require user interaction (UI:R), such as a victim visiting a specifically crafted URL. Because the vulnerability results in a scope change (S:C), the impact can extend beyond the immediate component to the user's session or the underlying server environment. Adobe has released patches to address this issue in the July 2026 update cycle.

Affected products

Adobe Adobe Commerce <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
Adobe Adobe Commerce B2B <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
Adobe Magento Open Source <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
Adobe Adobe Commerce Webhooks Plugin <= 1.20.0

Identifiers

CVE-2026-48356
CVE-2026-111497

Timeline

2026-07-14: disclosed
2026-07-14: advisory

References

https://helpx.adobe.com/security/products/magento/apsb26-73.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.