Adobe Commerce: Unrestricted file upload leading to code execution
Deadline for US federal agencies: 10 Nov 2026
Summary
Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events contain an Unrestricted Upload of File with Dangerous Type flaw (CWE-434). An attacker can upload a file of a dangerous type and execute arbitrary code in the context of the current user, which may lead to elevated access or control over the victim's account or session. The record states that exploitation requires user interaction, such as visiting a crafted URL or a compromised web page, and marks the scope as changed. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, and attacks against online stores have been reported.
Affected
- Adobe Commerce: up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18
- Adobe Commerce B2B: up to and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18
- Magento Open Source: up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15
- Adobe Commerce Events: up to and including 1.20.0
Fixed in
- Adobe Commerce: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
- Adobe Commerce B2B: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
- Magento Open Source: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
- Adobe Commerce Events: 1.21.0
Verify the exact build names in Adobe's advisory before rollout. Isolated patches may only apply cleanly to a specific prior patch level.
Workaround
Unknown. Adobe documents no workaround for unpatched systems.
- Remove any identified webshells and backdoors, then apply the patch
- Rotate database, administrator and API integration credentials after a suspected compromise
- Search CMS blocks and page content for injected scripts
Exploitation
- CISA lists the flaw as known exploited, added on 27 October 2026
- Sansec reports a JavaScript loader campaign in the CMS blocks of 953 stores and assesses that it is linked to this flaw
- Public proof-of-concept exploit: Unknown
Our recommendation
- Inventory all Adobe Commerce, B2B, Magento Open Source and Events instances and their exact patch levels
- Apply the July 2026 build that matches each installation without delay
- If a store was exposed before patching, run a compromise assessment (CMS content, pub/media upload folders, admin accounts, backdoors) and rotate credentials before declaring it clean
- Monitor the Adobe advisory and the CISA and Sansec pages for updates
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
abraxas/CVE-2026-48356
Research sources
- Adobe security bulletin APSB26-73 helpx.adobe.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- Sansec: Magento CMS block loader campaign (deepveindrilling.com) sansec.io
- Sansec: PolyShell mass attack wave sansec.io
- SentinelOne vulnerability database entry www.sentinelone.com
- Intruder CVE monitor entry cvemon.intruder.io
- Everyhost: Adobe Commerce security update APSB26-73 everyhost.co.uk
- GBHackers: Magento CMS blocks campaign gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:31.
Original description (NVD)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.