{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incident": { "id": "cve-2026-48356", "url": "https://cveboard.org/i/cve-2026-48356", "urlPt": "https://cveboard.org/pt/i/cve-2026-48356", "json": "https://cveboard.org/i/cve-2026-48356.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "critical", "title": "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability", "summary": "Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.", "titlePt": "Adobe Commerce e Magento: Vulnerabilidade de Upload Irrestrito de Arquivo com Tipo Perigoso", "summaryPt": "Adobe Commerce e Magento contêm uma vulnerabilidade de upload irrestrito de arquivo com tipo perigoso que pode resultar na execução arbitrária de código no contexto do usuário atual, potencialmente ganhando acesso ou controle elevado sobre a conta ou sessão da vítima.", "affected": [ { "vendor": "Adobe", "product": "Adobe Commerce", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": null, "lessThanOrEqual": "2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18" }, { "version": "2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "Adobe", "product": "Adobe Commerce B2B", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18" }, { "version": "1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "Adobe", "product": "Magento Open Source", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": null, "lessThanOrEqual": "2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15" }, { "version": "2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "Adobe", "product": "Adobe Commerce Events", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.20.0" }, { "version": "1.21.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "1.21.0" ] } ], "omitted": 0, "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-73.html", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type (CWE-434)" } ], "ssvc": { "exploitation": "active", "automatable": "no", "impact": "total", "at": "2026-10-27T19:53:15.501Z" }, "fix": "listed", "tags": [ "adobe" ], "cves": [ "CVE-2026-48356" ], "ghsa": null, "cvss": { "score": 9.3, "version": "3.1", "by": "adobe" }, "epss": { "percentage": 0.30582, "percentile": 0.98231, "asOf": "2026-10-27", "by": "FIRST" }, "packages": [], "vendor": "Adobe", "product": "Commerce and Magento", "kev": { "dateAdded": "2026-10-27", "dueDate": "2026-11-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-27T00:00:00.000Z", "updatedAt": "2026-10-27T00:00:00.000Z" }, "live": true, "events": [ { "id": "kev:CVE-2026-48356:kev_added:2026-10-27T00:00:00.000Z", "incidentId": "cve-2026-48356", "type": "kev_added", "at": "2026-10-27T00:00:00.000Z", "detail": { "dueDate": "2026-11-10", "ransomware": false } } ] }