HIGH CISA-KEV ACTIVELY EXPLOITED PoC
CVE-2026-48356
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Affected Products
- Adobe: Commerce and Magento
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-48356
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
This high severity vulnerability was published on 2026-10-27 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 30.6% (top 2% of all CVEs by exploitation probability). Affected: Adobe: Commerce and Magento.
Risk Timeline
CVE Disclosed2026-10-27 · 0 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity
Remediation Resources
vulnfeed aggregates 18943 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.