CRITICALCVSS 9.3Actively exploited · CISA KEV since 2026-10-27Vulnerability
CVE-2026-48356
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Properties
- Vulnerability name
- Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- Cvss score
- 9.3
- Epss score
- 0.30582
- Due date
- 2026-11-10
- Retrieved at
- 2026-10-27T23:35:49+00:00
- Date added
- 2026-10-27
- Score
- 9.3
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- In Signal since
- initial import (Sep 2026)
- Vendor project
- Adobe
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Published at
- 2026-07-14T20:17:08.437
- Last modified
- 2026-08-28T00:17:52.187
- Epss percentile
- 0.98231
- Severity
- CRITICAL
- Licence
- FIRST EPSS: free to use; attribution requested in publications or products (FAQ)
- Product
- Commerce and Magento
- Cvss severity
- CRITICAL
- Signal source
- FIRST EPSS
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon
Related Entities (175 · showing 24)
AFFECTS_PRODUCT (171 · showing 20)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
MENTIONED_IN (1)
Explore deeper with Ninja Signal's threat intelligence graph