CISA confirms a critical Adobe Commerce upload bug is under attack
A file-upload flaw in Adobe Commerce and Magento, patched quietly in July, is now on the Known Exploited Vulnerabilities catalogue with a federal deadline of 10 November.
CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalogue on 27 October, confirming active exploitation of a critical Adobe Commerce and Magento bug. Federal civilian agencies have until 10 November to patch.
The flaw is an unrestricted file upload (CWE-434) that needs no login to trigger and leads to privilege escalation, scoring CVSS 9.6. It hits Adobe Commerce 2.4.9 and every branch back to 2.4.4-p18, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Events. Adobe actually fixed it in July’s APSB26-73 bulletin, stating at the time that it had seen no exploitation. CISA’s catalogue entry means that is no longer true, roughly three months after the patch went out.
Why it matters: this is the same pattern as plenty of other KEV additions this year: a fix sits available for months while attackers take their time building a working exploit against the sites that never applied it. If you run Adobe Commerce or Magento Open Source and haven’t moved to one of the -2026-jul builds, this is the week that changes from “overdue” to “actively targeted”.
The caveat: the 10 November deadline binds only US federal agencies. Everyone else running an unpatched store just gets to know the exploitation is real, not theoretical.