CISA adds Adobe Commerce and Magento flaw to KEV catalogue

CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026. The vulnerability affects Adobe Commerce and Magento and could allow an attacker to execute arbitrary code through an unrestricted upload of a file with a dangerous type.

The flaw may let an attacker run code in the context of the current user, potentially gaining elevated access or control over that user’s account or session. The available data does not specify a more detailed attack vector. CVE-2026-48356 has a CVSS score of 9.3, rated Critical. Adobe has made a patch available and published a security advisory for the affected products.

A KEV listing means CISA has confirmed that the vulnerability is being actively exploited. The available entry data does not confirm whether attackers have used it in ransomware campaigns; that status is listed as unknown. CISA’s remediation deadline is 10 November 2026, giving affected organisations a short window to address the risk.

CISA requires organisations to apply mitigations in accordance with Adobe’s instructions and comply with its BOD 26-04 guidance on prioritising security updates based on risk, as well as its Forensics Triage Requirements. For cloud services, organisations should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must evaluate each asset’s internet exposure and follow BOD 26-04 patching guidance.

These requirements apply directly to Federal Civilian Executive Branch (FCEB) agencies. All organisations using Adobe Commerce or Magento should review their exposure and apply Adobe’s available update.

For full details, see the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-48356) and [CISA’s KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).