Your Magento shop needs the July patch
CISA lists a Magento and Adobe Commerce file-upload bug as exploited. Adobe's July 14 update fixes it. Check your store's version today.
Adobe fixed this Magento bug in July. If your shop never installed that update, the bug is now on the US government's catalog of known exploited vulnerabilities. It lets someone upload a dangerous file that "could result in arbitrary code execution in the context of the current user," says the US Cybersecurity and Infrastructure Security Agency (CISA), and the fix has been out since Adobe's July 14, 2026 security bulletin.
CISA added the flaw, CVE-2026-48356, to its Known Exploited Vulnerabilities catalog on Oct 27, 2026, listing the product as "Commerce and Magento". A listing there means CISA knows the flaw has been exploited. CISA's required action is to "Apply mitigations in accordance with vendor instructions", which here means Adobe's update.
An attacker could gain a user's access to your store
Adobe's bulletin APSB26-73 rates the bug Critical and says no authentication is required to exploit it. The US National Vulnerability Database (NVD) also rates it critical. In plain terms, a stranger who never logged in could get a harmful file onto your store, and CISA says it could be used to run code with the access of the user it reaches.
There is one condition. NVD says "a victim must visit a maliciously crafted URL or interact with a compromised web page."
The bulletin covers Adobe Commerce, Adobe Commerce B2B, Magento Open Source and the Adobe Commerce Events extension, which is fixed in version 1.21.0. Its affected list runs from 2.4.9 down through older patch releases, for example "2.4.8-p5 and earlier". Magento Open Source 2.4.5 and 2.4.4 are not in Adobe's list.
Adobe's page still says it knows of no attacks
"Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates," the bulletin says. That page was last updated on Aug 11, 2026. CISA's listing came later, on Oct 27. Adobe has not updated the bulletin to reflect it.
CISA lists known ransomware use as "Unknown".
The fix has been out since July 14
In our view, this is catch-up work, not a new problem. The fix has been available since July 14, and CISA's listing means it should not wait.
Picture, as our own example, a two-person shop selling handmade candles, whose developer applies updates when there's time. July came and went without the update. That is the store this listing should worry.
What this means for your business
Today, look up which version your Magento or Adobe Commerce store runs. Your developer or host can tell you.
Adobe's fixed versions for Adobe Commerce, Adobe Commerce B2B and Magento Open Source end in -2026-jul, for example "2.4.8-2026-jul". If your store is not on one of those, install the July update yourself, or ask your developer or host to do it this week. Adobe "recommends users update their installation to the newest version." Check your exact version against the full list in Adobe's bulletin rather than guessing.
If you are on Magento Open Source 2.4.5 or 2.4.4, ask your developer what to do, since Adobe's list does not include them.
Neither CISA, NVD nor Adobe has said who is using the bug, how or at what scale.
Sources
- CISA Known Exploited Vulnerabilities catalog (JSON feed).
- NVD, CVE-2026-48356.
- Adobe security bulletin APSB26-73.
This article was researched, written and fact-checked by MasterNodeAI's AI newsroom agents.
Related: Security & Regulation desk
MasterNodeAI is building an AI interface that helps small and medium business owners run their business. Join the waitlist and we will let you know when you can try it.