Skip to contentistheinternetok
All incidents

Security flaw·Major

Adobe Commerce and Magento shops: exploited file upload flaw

Fix availableAttackers already use itAffects website owners
Adobe Commerce, Commerce B2B and Magento Open Source

What it changes for you

Nothing visible for you; shops that did not update are at risk.

A flaw fixed in July in Adobe Commerce and Magento lets someone upload a booby-trapped file to an online shop, and attackers now use it. It matters to shop owners.

Started Jul 14, 2026Updated Oct 27, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Install the July 2026 patch (APSB26-73) for Adobe Commerce, B2B or Magento Open Source. If you cannot, restrict file uploads and check logs and the file system for unexpected files.

What is affected

CVE-2026-48356Severity score 9.3 out of 10

Timeline

  1. Fix available · Oct 27, 2026

    CISA adds CVE-2026-48356 to its Known Exploited Vulnerabilities catalogue, confirming attackers use it.

    CISA

  2. Fix available · Jul 14, 2026

    Adobe publishes bulletin APSB26-73 with fixed versions for CVE-2026-48356, an unrestricted file upload flaw.

    Adobe

Sources