Adobe Commerce and Magento: exploited file upload flaw allows code execution

What happened

Adobe Commerce and Magento contain an unrestricted file upload vulnerability, tracked as CVE-2026-48356. It allows files with a dangerous type to be uploaded, which can result in arbitrary code execution in the context of the current user and may give an attacker elevated access or control over a victim's account or session.

The vulnerability has been public since July 14, 2026. CISA confirmed active attacks on October 27, 2026: systems that have not been updated since the disclosure are now at acute risk.

The vulnerability has a CVSS base score of 9.3. It is being actively exploited and has been added to the CISA Known Exploited Vulnerabilities catalog. Adobe addresses it in security bulletin APSB26-73. The security firm Sansec has published research on related attacks against Magento shops, including indicators of compromise (linked below).

Who is affected

Operators of Adobe Commerce and Magento shops. The source data does not list the exact affected and fixed versions. Check Adobe's bulletin APSB26-73, linked below, to see whether your version is affected and which release contains the fix.

Because the flaw is exploited in the wild, any internet-facing shop that has not yet received the update should be treated as at risk.

What to do now

1. Identify all Adobe Commerce and Magento installations you manage, including staging and development copies that are reachable from the internet, and note their versions.
2. Compare those versions with the affected and fixed versions in Adobe bulletin APSB26-73.
3. Back up the code base, the app/etc configuration and the database.
4. Put the shop into maintenance mode and apply the update or patch provided by Adobe in APSB26-73, following Adobe's instructions for your installation method (for example Composer).
5. Run bin/magento setup:upgrade, recompile with bin/magento setup:di:compile and redeploy static content if you run in production mode, then flush the cache with bin/magento cache:flush.
6. Disable maintenance mode and check that the storefront, checkout and admin panel work as expected.
7. If you cannot update immediately, follow the mitigations in Adobe's bulletin. If no mitigation is possible, consider taking the shop offline until it is patched.

How to check whether you are affected

• Check your installed version with bin/magento --version or in composer.lock and compare it with APSB26-73.
• Because the flaw is actively exploited, check patched shops for signs of an earlier compromise as well. Compare your systems against the indicators of compromise published by Sansec.
• Look for unexpected files, especially executable scripts, in writable directories such as pub/media, and for recently modified files in the code base.
• Review web server access logs for unusual upload requests and for requests to unfamiliar files in upload directories.
• Check the admin user list and recent CMS changes for entries you do not recognise.
• If you find signs of compromise, isolate the shop, preserve logs for analysis, remove the malicious files, and rotate admin, database and API credentials after cleaning up.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-48356
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog