Our takeCISA added the unrestricted file upload flaw in Adobe Commerce and Magento to its KEV catalog — it's actively exploited. Patch immediately if you run self-hosted instances.Security Resilience desk
Sources (5)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- hackernews · hackernews
- securityweek · securityweek
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA added CVE-2026-48356 (unrestricted dangerous file upload in Adobe Commerce/Magento) to the KEV catalog; active exploitation is confirmed. Patch self-hosted instances immediately per Adobe guidance and treat as priority under BOD 22-01.
What this means for you — Lean IT orgs:If you run your own Adobe Commerce or Magento store, update it right away — this vulnerability lets attackers upload dangerous files and take control.
What this means for you — MSP:Check client environments for self-hosted Adobe Commerce or Magento instances and ensure the patch for CVE-2026-48356 is applied; this is now a KEV-listed actively exploited flaw.
What this means for you — Researcher:CISA added CVE-2026-48356 in Adobe Commerce and Magento (unrestricted upload of dangerous file type leading to RCE) to the KEV catalog based on confirmed active exploitation.