CVE-2026-48356
Adobe Adobe Commerce
Summary
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim…
Published: 2026-07-14 · In KEV since: 2026-10-27
Analysis
🔴 Critical — actively exploited
Weakness: Unrestricted File Upload (CWE-434). Allows uploading dangerous files (e.g. webshells).
How it's exploited: Exploitable over the network (internet-reachable), unauthenticated, if the victim interacts (open a file/click), and with low complexity. The flaw can pivot to other components (scope changed).
Impact: Confidentiality high · Integrity high · Availability none.
Status: Active exploitation confirmed by CISA (KEV).
- Patch now: it is in CISA's actively-exploited catalog (KEV), with a deadline.
- Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
- Awareness: the attack needs victim interaction (phishing/file).
- Detect: turn this CVE into detection rules.
MITRE ATT&CK technique: T1190 · Exploit Public-Facing Application
Practice it in the arsenal: WAF Bypass
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →
Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.