CriticalCVE-2026-48356

Adobe Commerce: Unrestricted Upload of File with Dangerous Type (CVE-2026-48356)

Published 28.10.2026Last modified 28.10.2026In CISA KEV since 27.10.2026Sources: BSI

What is affected, what to do

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

The vulnerability is being actively exploited; treat it as a priority. Update i\/o_events to version 1.21.0, Magento to version 2.4.6-2026-jul. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: Adobe Commerce lte 2.4..2.4.9
Adobe Commerce lte 2.4..2.4.8-p5
Adobe Commerce lte 2.4..2.4.7-p10
Adobe Commerce lte 2.4..2.4.6-p15
Adobe Commerce lte 2.4..2.4.5-p17
Adobe Commerce lte *..2.4.4-p18
Adobe Commerce B2B lte 1.5..1.5.3
Adobe Commerce B2B lte 1.5..1.5.2-p5
Adobe Commerce B2B lte 1.4..1.4.2-p10
Adobe Commerce B2B lte 1.3..1.3.4-p17
Adobe Commerce B2B lte *..1.3.3-p18
Adobe Magento Open Source lte 2.4..2.4.9
Adobe Magento Open Source lte 2.4..2.4.8-p5
Adobe Magento Open Source lte 2.4..2.4.7-p10
Adobe Magento Open Source lte *..2.4.6-p15
Adobe Commerce Events lte *..1.20.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

9.3

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

9.3

CVSS v3

Severity Critical on the scale from 0 to 10.

Source: BSI

47.5 %

EPSS score

Elevated — model estimates 10-50% exploitation likelihood.

Source: FIRST EPSS, percentile 98.9

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 188.14 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 9.3 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 9.3
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 47.5 %; Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 98.9; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 28.10.2026
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 27.10.2026
CISA assessment (SSVC): Exploitation: active · not automatable · Technical impact: total; Source: CISA Vulnrichment, as of 14 July 2026
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-434

Response and mitigation

Why act now?

Prioritisation rationale

The flaw is network-reachable without authentication but needs user interaction: a victim, typically an admin or shop staff member, has to open a crafted link or compromised page. Because the scope changes, the attacker can then take over the session or account and execute code. KEV listing confirms real-world exploitation even though the statistical exploitation likelihood is only moderate. Commerce flaws are historically used for payment-card skimming, webshells and admin account takeover; CISA reports no known ransomware use. Treat internet-facing shops that process payments (PCI DSS and GDPR exposure) as critical, with a 24–72 h patch window. Internal or fully allowlisted instances can sit one tier lower.

01
Runbook step 1
Immediate response (0-24 h)
- Apply the vendor security update: Affected versions are Adobe Commerce 2.4.4-p18, 2.4.5 through 2.4.5-p17, 2.4.6 through 2.4.6-p15, 2.4.7 through 2.4.7-p10, 2.4.8 through 2.4.8-p5 and 2.4.9, plus Adobe Commerce B2B 1.5 through 1.5.3 (including 1.5.2-p5). A patch is available from the vendor; look up the fixed version in the Adobe Security Bulletin (APSB) for CVE-2026-48356. Treat Magento Open Source as affected until the bulletin confirms otherwise.
- Build a complete inventory: Cover every Commerce/Magento instance, including staging, agency-hosted and forgotten campaign sites. Check versions with bin/magento --version and patch level with composer show magento/product-*.
- Hunt for compromise before patching: find pub/media pub/static -type f $ -name "*.php*" -o -name "*.phtml" -o -name "*.phar" -o -name "*.svg" -o -name "*.htm*" -o -name "*.js" $ -newermt "2026-09-01". Preserve any hits forensically before removing them.
- Reset admin sessions and credentials: The flaw targets the victim's session and account. Kill all admin sessions (truncate admin_user_session), rotate admin passwords and integration/API tokens, and review whether the crypt/key in app/etc/env.php needs rotating.
- Check config and content integrity: In core_config_data, review design/head/includes, design/footer/absolute_footer and design/head/miscellaneous_scripts. Also inspect cms_block and cms_page for injected <script> tags or unknown external domains, which is the classic skimmer pattern.
- Until patched: Restrict the admin path to an IP allowlist or VPN, and warn admin users not to open externally sent links to shop or admin URLs.
02
Runbook step 2
Mitigation layers
- Web server config: Block execution in upload paths. In nginx: location ~* ^/(pub/)?media/.*\.(php|phtml|phar|pl|py|sh|cgi)$ { deny all; }. Serve .html, .svg and .xml under /media/ with Content-Disposition: attachment and X-Content-Type-Options: nosniff. Diff your config against nginx.conf.sample and the .htaccess in pub/media.
- WAF/IPS: Block multipart uploads to Commerce endpoints whose filename= has a dangerous extension (.php, .phtml, .phar, .svg, .html, or double extensions like .jpg.php). Also flag uploads where the magic bytes don't match the declared Content-Type. Paths to cover include /rest/*/V1/, /customer/address/, custom-option uploads and /admin/*/upload.
- Browser-side hardening: Run CSP (Magento_Csp) in restrict mode with allowlisted script-src and connect-src, and send report-uri output to the SIEM. This limits execution in the victim's context and makes exfiltration attempts visible.
- IAM/least privilege: Enforce admin 2FA and use a non-default admin URL. Trim admin roles to what each user needs, and have admins work only from a dedicated browser profile.
- Filesystem hardening: In production, the PHP-FPM user gets no write access to code directories (app/, vendor/, generated/). Mount pub/media with noexec, and monitor pub/ and app/ with file integrity monitoring (e.g. AIDE or Wazuh FIM).
- Network segmentation: Use egress filtering to limit the web tier to payment providers, package repos and Adobe services. Allow database access only from the app segment.
03
Runbook step 3
Detection rules
- Web access logs: Look for a multipart POST followed by a GET on a newly created file under /media/. SPL: index=web uri_path="*/media/*" (uri_path="*.php*" OR uri_path="*.phtml" OR uri_path="*.svg" OR uri_path="*.html") status=200 | stats count by src_ip, uri_path.
- EDR process ancestry: Alert when php-fpm, apache2 or nginx spawns sh, bash, curl, wget, python or base64. A Linux Sigma rule can match ParentImage|endswith: '/php-fpm*' with Image|endswith: ['/sh','/bash','/curl','/wget']. Auditd alternative: -a always,exit -F arch=b64 -S execve -F euid=www-data -k web_exec.
- File integrity (FIM/auditd): Watch for new or modified files under pub/media/, pub/static/ and app/code/, e.g. -w /var/www/magento/pub/media -p wa -k magento_upload. Alert on any extension outside the permitted image formats.
- Application/DB layer: Flag new admin_user rows, changes to authorization_role, and new integrations in oauth_token and integration. Also flag admin logins from new IPs or ASNs shortly after a click from an external referrer (admin_user_session.ip).
- Network (Zeek/Suricata): Watch for outbound HTTP(S) from the web tier, or customer-browser beacons, to non-allowlisted domains. Correlate with CSP violation reports showing unknown blocked-uri values, a strong signal of injected skimmer scripts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Source: BSI WID Portal

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Adobe	Adobe Commerce	`2.4 – ≤ 2.4.5-p17` `2.4 – ≤ 2.4.6-p15` `2.4 – ≤ 2.4.7-p10` `2.4 – ≤ 2.4.8-p5` `2.4 – ≤ 2.4.9` `≤ 2.4.4-p18`	— — — — — —
Adobe	Adobe Commerce B2B	`1.3 – ≤ 1.3.4-p17` `1.4 – ≤ 1.4.2-p10` `1.5 – ≤ 1.5.2-p5` `1.5 – ≤ 1.5.3` `≤ 1.3.3-p18`	— — — — —
Adobe	Adobe Commerce Events	`≤ 1.20.0`	—
Adobe	Magento Open Source	`2.4 – ≤ 2.4.7-p10` `2.4 – ≤ 2.4.8-p5` `2.4 – ≤ 2.4.9` `≤ 2.4.6-p15`	— — — —
adobe	commerce	`2.4.4` `2.4.5` `2.4.6` `2.4.7` `2.4.8` `2.4.9`	— — — — — —
adobe	commerce_b2b	`1.3.3` `1.3.4` `1.4.2` `1.5.2` `1.5.3`	— — — — —
adobe	i\/o_events	`1.6.0 – < 1.21.0`	`1.21.0`
adobe	magento	`2.4.6` `2.4.7` `2.4.8` `2.4.9`	— — — —
Adobe	Magento	`< 2.4.6-2026-jul` `< 2.4.7-2026-jul` `< 2.4.8-2026-jul` `< 2.4.9-2026-jul`	`2.4.6-2026-jul` `2.4.7-2026-jul` `2.4.8-2026-jul` `2.4.9-2026-jul`

From bundled advisories, not CVE-specific (3)

Product list of a bundled advisory that does not state which product this CVE affects.

Products from bundled advisories
		Affected versions	Fixed in
—	Adobe Commerce / Magento Open Source	`Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier without APSB26-73 (CVE-2026-48356)` `Fully patched stores that already have a rogue admin account or backdoor from an earlier compromise` `Stores missing APSB25-88 (SessionReaper, CVE-2025-54236)`	— — —

Vendors and products

Weakness classes (CWE)

CWE-434Unrestricted Upload of File with Dangerous Type
Base
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Entry at MITRE CWE-434

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	27.10.2026
PoC-in-GitHub (nomi-sec)	CVE-2026-48356 (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	26.09.2026

References & sources

helpx.adobe.comsecurity/products/magento/apsb26-73.htmlVendor advisory
pwn.watchpwn.watch: Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaperpwn-watch
sansec.iodeepveindrilling.com: Magento CMS block loader hits 953 storespwn-watch
NVD (NIST)NVD: CVE-2026-48356pwn-watch
thehackernews.comHackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magentopwn-watch
securityweek.com953 Online Stores Infected in Long-Lasting Malware Campaignpwn-watch
sansec.ioresearch/magento-cms-block-loader-deepveindrillingThird-party advisory, Third-party advisory
sansec.ioresearch/polyshell-mass-attack-waveThird-party advisory, Third-party advisory
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356government-resource, US government resource
cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

28.10.2026NVD analysis modifiedNVD

New references:

Show 3 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference type	added	—	CISA-ADP: https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise Types: Third Party Advisory
Reference type	added	—	CISA-ADP: https://sansec.io/research/polyshell-mass-attack-wave Types: Third Party Advisory
Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356 Types: US Government Resource

Source identifier: nvd@nist.gov

28.10.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: no

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
SSVC assessment	removed	{"id":"CVE-2026-48356","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T19:53:15.501701Z"}	—
SSVC assessment	added	—	{"id":"CVE-2026-48356","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-14T00:00:00+00:00"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

27.10.2026CISA KEV entry updated9119a7d8…
4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name
Show 4 original changes
Individual changes of this event as published by NVD
Type Action Before After
Date Added added
—
2026-10-27
Due Date added
—
2026-10-27
Required Action added
—
2026-10-27
Vulnerability Name added
—
2026-10-27
Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

Individual changes of this event as published by NVD
Type	Action	Before	After
Date Added	added	—	2026-10-27
Due Date	added	—	2026-10-27
Required Action	added	—	2026-10-27
Vulnerability Name	added	—	2026-10-27

27.10.2026Record modifiedCISA ADP

CISA assessment (SSVC): exploitation: active, automatable: no

New references:

Show 5 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise
Reference	added	—	https://sansec.io/research/polyshell-mass-attack-wave
Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
SSVC assessment	removed	{"id":"CVE-2026-48356","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-15T04:01:07.185615Z"}	—
SSVC assessment	added	—	{"id":"CVE-2026-48356","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T19:53:15.501701Z"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

28.08.2026Record modifiedAdobe

1 individual change: Affected versions (publisher)

Show the original change

Individual changes of this event as published by NVD
Type	Action	Before	After
Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/48xxx/CVE-2026-48356.json">CVE-2026-48356</a>

Source identifier: psirt@adobe.com

Show 2 older changes

27.08.2026Record modifiedAdobe

New references:

https://helpx.adobe.com/security/products/magento/apsb26-73.html

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/48xxx/CVE-2026-48356.json">CVE-2026-48356</a>
Reference	added	—	https://helpx.adobe.com/security/products/magento/apsb26-73.html
Reference	removed	https://helpx.adobe.com/security/products/magento/apsb26-73.html	—
Reference type	removed	https://helpx.adobe.com/security/products/magento/apsb26-73.html Types: Vendor Advisory	—

Source identifier: psirt@adobe.com

21.07.2026Record modifiedAdobe

CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVSS V3.1: before AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L, after —

Description added or changed

Show 3 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Description	changed	Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.	Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS	added	—	AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS	removed	AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L	—

Source identifier: psirt@adobe.com

Linked CVEs

Linked CVEs

Medium	CVE-2026-48371	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)	5.4	—
Critical	CVE-2026-48358	Adobe Commerce \| Improper Encoding or Escaping of Output (CWE-116)	9.1	—
Critical	CVE-2026-48356	Adobe Commerce \| Unrestricted Upload of File with Dangerous Type (CWE-434)	9.3	Actively exploited
Low	CVE-2026-48001	Adobe Commerce \| Information Exposure (CWE-200)	3.7	—
Medium	CVE-2026-48000	Adobe Commerce \| URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)	6.1	—
Medium	CVE-2026-47999	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)	4.8	—
Medium	CVE-2026-47998	Adobe Commerce \| Incorrect Authorization (CWE-863)	5.9	—
Medium	CVE-2026-47997	Adobe Commerce \| Incorrect Authorization (CWE-863)	5.9	—
Medium	CVE-2026-47996	Adobe Commerce \| Incorrect Authorization (CWE-863)	6.8	—
High	CVE-2026-47995	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)	8.1	—
High	CVE-2026-47994	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)	8.7	—
High	CVE-2026-47992	Adobe Commerce: SQL Injection	7.2	—
High	CVE-2026-47988	Adobe Commerce \| Incorrect Authorization (CWE-863)	8.6	—
High	CVE-2026-47984	Adobe Commerce \| Incorrect Authorization (CWE-863)	8.2	—

Linked advisories

@RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28SANS @RISK23.07.2026

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2026-48356"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-48356.svg?lang=en" alt="CVE-2026-48356 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Weakness classes (CWE)

Public exploit references

References & sources

Changes to this CVE

Linked CVEs

Linked advisories