CISA added CVE-2026-48356, an unrestricted upload of file with dangerous type flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a remediation due date of 10 November 2026 for US federal agencies; CISA lists known ransomware use as Unknown and points to Adobe bulletin APSB26-73.

According to the CVE record from Adobe (published 14 July 2026), the flaw could result in arbitrary code execution in the context of the current user, exploitation requires user interaction (a victim visiting a crafted URL or interacting with a compromised page), and the scope is changed. The record lists Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events 1.20.0 and earlier as affected.

Adobe's own bulletin APSB26-73 (published 14 July 2026) rates CVE-2026-48356 Critical with a CVSS 3.1 base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), lists its impact as privilege escalation and says no authentication is required to exploit it; the CVE record gives 9.3 and arbitrary code execution.

Both are shown here as each source states them.

Correction (28 Oct 2026): Adobe's bulletin APSB26-73, which was unreadable on the previous pass, is now readable and gives a CVSS score of 9.6 with privilege escalation as the impact, while the CVE record gives 9.3 and arbitrary code execution; the card now shows both, each credited. (source: Adobe)