CVE-2026-48356Commerce Unrestricted File Upload
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user.
Published Jul 14, 2026 · Updated Oct 29, 2026 · Also known as EUVD-2026-44420, GHSA-p3ch-8535-fp8j
Key Facts
Patch immediately- CVE-2026-48356 is a critical-severity vulnerability (CVSS 9.3 v3.1) affecting Commerce (Adobe), Commerce B2b (Adobe), I\/o Events (Adobe) and 4 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 24, 2026. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 59% probability of exploitation in the next 30 days.
- Fixed versions are available, including I\/o Events 1.21.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS (30-day exploit likelihood)
59%
Higher than 99.1% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
77/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Oct 27, 2026
105 days after publication
Federal due date
Nov 10, 2026
12 days left
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Required action (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Advisories And Exploit References
Description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Oct 27, 2026 | Nov 10, 2026 | Not reported |
| Industry KEV feed | Oct 24, 2026 | Nov 10, 2026 | Not reported |
| CIRCL KEV | Oct 27, 2026 | Nov 10, 2026 | Not reported |
| ENISA EUVD | Oct 27, 2026 | n/a | Not reported |
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Products
180 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| CommerceAdobe | 2.4.4, 2.4.4-p1, 2.4.4-p10, 2.4.4-p11, 2.4.4-p12, 2.4.4-p13, 2.4.4-p14, 2.4.4-p15 | n/a |
| Commerce B2bAdobe | 1.3.3, 1.3.3-p1, 1.3.3-p10, 1.3.3-p11, 1.3.3-p12, 1.3.3-p13, 1.3.3-p14, 1.3.3-p15 | n/a |
| I\/o EventsAdobe | See advisory | 1.21.0 |
| MagentoAdobe | 2.4.6, 2.4.6-p10, 2.4.6-p11, 2.4.6-p12, 2.4.6-p13, 2.4.6-p14, 2.4.6-p15, 2.4.6-p1 | n/a |
| Adobe Commerce Events | See advisory | n/a |
Patched Releases
I\/o Events
1.21.0
Timeline
Publicly disclosed
Jul 14, 2026
Added to Industry KEV feed
Oct 24, 2026
Added to CISA KEV
Oct 27, 2026
Added to CIRCL KEV
Oct 27, 2026
Added to ENISA EUVD
Oct 27, 2026
Last updated
Oct 29, 2026
Weakness Type
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-48356
- advisorysansec.io · magento-cms-block-loader-deepveindrilling
- advisorysansec.io · polyshell-mass-attack-wave
- exploitVulnCheck exploitation report
FAQ
Common Questions.
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Affected: Commerce (Adobe) versions 2.4.4, 2.4.4-p1, 2.4.4-p10, 2.4.4-p11, 2.4.4-p12, 2.4.4-p13, 2.4.4-p14, 2.4.4-p15; Commerce B2b (Adobe) versions 1.3.3, 1.3.3-p1, 1.3.3-p10, 1.3.3-p11, 1.3.3-p12, 1.3.3-p13, 1.3.3-p14, 1.3.3-p15; I\/o Events (Adobe), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 24, 2026.
Yes. It was added on Oct 27, 2026 with a federal remediation due date of Nov 10, 2026.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including I\/o Events 1.21.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-48356 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo