Source: cisa.gov
CVE-2026-48356 affects Adobe Commerce and Magento platforms, involving an unrestricted upload of file with dangerous type vulnerability. Successful exploitation could allow arbitrary code execution in the context of the current user. This may lead to elevated access or full control over the victim's account or session. The vulnerability is tracked by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Adobe has published an advisory (APSB26-73) with guidance and patches. CISA also provides forensic triage requirements for affected organizations. The vulnerability is catalogued in the NVD and rated High severity. Organizations running Adobe Commerce or Magento are strongly advised to apply available patches immediately.
