Online stores built on Adobe Commerce or Magento have a serious flaw to fix. On Oct. 27, 2026, CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog, citing evidence that attackers are using it.
The catalog entry set a due date of Nov. 10, 2026, which has now passed. That date applies to federal civilian agencies, but CISA urges all organizations to put flaws on its list near the top of their patch work.
Key facts
- CISA added CVE-2026-48356 to the KEV catalog on Oct. 27, 2026, based on active exploitation.
- The KEV entry names Adobe Commerce and Magento and gives a due date of Nov. 10, 2026.
- NVD gives the flaw a CVSS v3.1 base score of 9.3, rated Critical.
- The flaw lets a dangerous file type be uploaded, which could lead to code running as the current user.
- NVD marks the 2026-jul updates for the affected product lines as unaffected.
Background
CISA's short description says the products allow an unrestricted upload of a dangerous file type. If abused, the bug could let an attacker run arbitrary code with the rights of the current user, the entry says. That could give the attacker higher access, or let them take over a victim's session or account, according to CISA.
The KEV entry tracks the weakness as CWE-434. It marks known ransomware use as Unknown and sets forensic triage to No. CISA's notes point readers to Adobe bulletin APSB26-73, to BOD 26-04 and its implementation guidance, and to the NVD record.
NVD lists CVE-2026-48356 as published on July 14, 2026, and last changed on Oct. 28, 2026. Its record also shows the CISA add date of Oct. 27, 2026, and the action due date of Nov. 10, 2026.
NVD's description says an attack needs user interaction. A victim must open a crafted URL or use a web page that has been compromised, NVD says, and the scope is changed.
BOD 26-04 covers Federal Civilian Executive Branch agencies. The directive requires them to move fast on high-risk flaws, meaning KEV entries on internet-facing assets that hand an attacker full control once exploited.
What it means for you
Most small businesses are not federal agencies, and CISA says the directive applies only to FCEB agencies. Still, CISA encourages every organization to use risk-based vulnerability management and fix KEV flaws first.
CISA added the flaw based on evidence of active exploitation, and NVD rates it Critical. NVD also says an attack needs a victim to open a crafted URL or a compromised web page.
NVD, citing Adobe, lists affected Adobe Commerce versions as those at or below 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18. For Magento Open Source, NVD lists versions at or below 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15.
Adobe Commerce B2B versions at or below 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18 are affected too. NVD also lists Adobe Commerce Events 1.6.0 through 1.20.0 as affected, with version 1.21.0 unaffected.
Our website development team can help plan and test safe updates for an online store. A custom app development review can help find add-ons and custom code that need a check after a patch. Owners weighing a bigger change can look at our website offer. For help with that choice, see when to replace your business website instead of patching it.
Practical steps
The required action in the KEV entry gives several paths. Apply fixes as the vendor directs, follow BOD 26-04 guidance and its forensics triage rules, follow BOD 26-04 guidance for cloud services, or stop using the product if no fix is available.
For a store team, that can look like this:
- Find out which version of Adobe Commerce, Magento Open Source, B2B or Events the store runs, and compare it with the NVD record.
- Read Adobe bulletin APSB26-73, which CISA's notes cite, for the vendor's own steps.
- Apply the vendor fix. NVD marks the 2026-jul updates as unaffected; whether a smaller patch is an option depends on Adobe's instructions.
- If no fix can be applied, the KEV entry says to stop using the product.
- Record what was changed and when, so the team can show the work later.
CISA's BOD 26-04 page offers a useful model even for private firms. It says agencies must fix each flaw as fast as they can and no later than the timelines in the directive's Table 1. The same page defines a fix as removing the flaw by patching, taking the system out of service, or another step.
What happens next
Federal agencies were due to act by Nov. 10, 2026. Stores that have not yet updated still face the same risk.
Some details are not known. There is no public count here of how many Adobe Commerce or Magento stores remain unpatched. The KEV entry lists ransomware use as Unknown. NVD last changed its record on Oct. 28, 2026, so it is worth checking again for updates.
