Zero Radar
← feed
CriticalVulnerabilityCVE-2026-48356updated 28 Oct 2026, 07:53 UTC

Adobe Commerce and Magento: file upload flaw allows code execution

A weakness lets someone upload a file of a dangerous type to the shop software, which can let them run their own code on the site and take over a logged-in user's account. The attacker typically needs a victim to visit a malicious link or a

Exploited (CISA KEV, NVD)Fix availableOfficial, 4 sources
SeverityCriticalCVSS 9.6 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 27 Oct 2026
Fix available?YesPatches are provided in Adobe security bulletin APSB26-73; exact fixed versions are not stated in the provided material. · since 27 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts linkMalicious URL or compromised page prepared
  2. 2Victim visits pageRequires user interaction to trigger
  3. 3Malicious file processedUnrestricted upload of dangerous file type
  4. 4Code runs in user contextArbitrary code execution in current session
  5. 5Account takeoverElevated access or control of account
  6. ResultAttacker controls victim's account and session

What happened

Adobe Commerce and Magento have an unrestricted file upload vulnerability (CWE-434) that can lead to arbitrary code execution in the context of the current user, with a changed scope. Exploitation requires user interaction.

Why it is dangerous: Successful exploitation can give an attacker elevated access or control over a victim's account or session, putting store data and administrator accounts at risk. CISA lists it in the Known Exploited Vulnerabilities catalog.

Are you affected?

You are affected if you run Adobe Commerce or Magento with a version covered by advisory APSB26-73.

Adobe Commerce and Magento (specific versions: see APSB26-73; not stated in the provided material)

What to do

  1. Apply the Adobe security update from bulletin APSB26-73 to your Adobe Commerce or Magento installation.
  2. If patching is not immediately possible, apply the mitigations in accordance with Adobe's vendor instructions.
  3. Evaluate internet exposure of each affected asset and prioritise patching per CISA BOD 26-04.
  4. Review systems for signs of compromise following CISA's forensics triage requirements.

Timeline

  1. 14 Jul 2026, 20:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 27 Oct 2026, 19:51 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 20:05 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 20:27 UTC
    NVD reported on it · NVD
  6. 27 Oct 2026, 20:27 UTC
    Fix: Patches are described in Adobe security bulletin APSB26-73; specific fixed versions not stated in the provided material. Apply mitigations per vendor instructions if a patch is unavailable.
  7. 28 Oct 2026, 07:53 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-48356 · GHSA-p3ch-8535-fp8j
CVSS
9.6 / 10
EPSS
45% chance of exploitation within 30 days
Disclosed
14 Jul 2026, 20:17 UTC
On Zero Radar
27 Oct 2026, 19:51 UTC (105 days after disclosure)
Last change
28 Oct 2026, 07:53 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Adobe Commerce and Magento: file upload flaw allows code execution · Zero Radar