CVE-2026-48356
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Early warning: exploitation observed
- Exploitation observed since Oct 24, 2026
- Not yet in the official CISA catalogue
- First attack observed 101 days after disclosure
Source: VulnCheck KEV · Oct 24, 2026
CVSS score9.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NWeakness type (CWE)CWE-434
Vendorsadobe
Affected products
| Vendors | Product | Versions |
|---|---|---|
| adobe | commerce | 2.4.4 |
| adobe | commerce b2b | 1.3.3 |
| adobe | magento | 2.4.6 |
| adobe | i\/o events | < 1.21.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.