Critical Adobe Commerce Flaw CVE-2026-48356 Actively Exploited for Remote Code Execution
A critical vulnerability tracked as CVE-2026-48356 and EUVD-2026-44420 affects Adobe Commerce and Magento Open Source, enabling attackers to execute arbitrary code in the victim's browser context. Exploitation requires no authentication and only needs the victim to visit a crafted URL or interact with a compromised website. The flaw stems from insufficient validation during file uploads, allowing dangerous file types to be uploaded and executed. Adobe has released patches since July 2026, yet CISA added the issue to its exploited vulnerabilities catalog on October 27, 2026. Affected products include multiple versions of Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and Adobe Commerce Events. Organizations are urged to apply the listed security updates immediately due to confirmed in-the-wild exploitation.
Security-InsiderNov 6, 2026Translated from German