What happened
An active exploitation campaign targeting Adobe Commerce and Magento has been identified, exploiting a vulnerability classified as CVE-2026-48356. This vulnerability involves an unrestricted file upload flaw that permits the execution of arbitrary code within the context of the affected user session. Successful exploitation could allow a threat actor to achieve elevated access, potentially leading to complete control over an affected system or user account. This critical security flaw is associated with CWE-434, which pertains to improper restriction of operations within the product. The vulnerability has been confirmed as being exploited in the wild, increasing the urgency for affected organisations to implement mitigations promptly.
Who is affected
Organisations running Adobe Commerce or Magento implementations are impacted by this vulnerability. All affected deployments are potentially vulnerable to remote code execution if mitigations are not applied. Due to the nature of the flaw, any deployment with accessible upload functionalities could be at risk, especially where current security controls do not adequately restrict file upload types or execution.
Recommended actions
- Stakeholders must apply mitigations in accordance with vendor instructions to address this vulnerability. It is essential to ensure compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk, as well as CISA’s forensic triage requirements. For cloud-based services, adherence to BOD 26-04 guidance is necessary, which may involve discontinuing use of the affected product if the necessary mitigations cannot be implemented. Organisations are responsible for evaluating the internet exposure of their assets and prioritising patching efforts accordingly. Given the active exploitation, prompt action may be necessary to reduce the risk of compromise.
