pwned.coffeeOrder ticket · today's special · 27 Oct 2026

🔥 On the fly · exploited in the wildKEV due in 14dScalding · 540°CcriticalOrder up · fix available

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe Commerce

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Added to CISA KEV on 2026-10-27 (federal deadline 2026-11-10).

Do this now

It is being exploited: install the update for your version: Adobe Commerce → 2.4.9-2026-jul; Adobe Commerce Events → 1.21.0; Adobe Commerce B2B → 1.5.3-2026-jul (+13 more lines in Fix it).

Fix it

Adobe Commerce

On 2.4.4.xUpgrade to Adobe Commerce 2.4.4-2026-jul
On 2.4.5.xUpgrade to Adobe Commerce 2.4.5-2026-jul
On 2.4.6.xUpgrade to Adobe Commerce 2.4.6-2026-jul
On 2.4.7.xUpgrade to Adobe Commerce 2.4.7-2026-jul
On 2.4.8.xUpgrade to Adobe Commerce 2.4.8-2026-jul
On 2.4.9.xUpgrade to Adobe Commerce 2.4.9-2026-jul
No fix on 2.4.9.x yet
No fix on 2.4.8.5.x yet
No fix on 2.4.7.10.x yet
No fix on 2.4.6.15.x yet
No fix on 2.4.5.17.x yet
No fix on 2.4.4.18.x yet

Adobe Commerce B2B

On 1.3.3.xUpgrade to Adobe Commerce B2B 1.3.3-2026-jul
On 1.3.4.xUpgrade to Adobe Commerce B2B 1.3.4-2026-jul
On 1.4.2.xUpgrade to Adobe Commerce B2B 1.4.2-2026-jul
On 1.5.2.xUpgrade to Adobe Commerce B2B 1.5.2-2026-jul
On 1.5.3.xUpgrade to Adobe Commerce B2B 1.5.3-2026-jul
No fix on 1.5.3.x yet
No fix on 1.5.2.5.x yet
No fix on 1.4.2.10.x yet
No fix on 1.3.4.17.x yet
No fix on 1.3.3.18.x yet

Magento Open Source

On 2.4.6.xUpgrade to Magento Open Source 2.4.6-2026-jul
On 2.4.7.xUpgrade to Magento Open Source 2.4.7-2026-jul
On 2.4.8.xUpgrade to Magento Open Source 2.4.8-2026-jul
On 2.4.9.xUpgrade to Magento Open Source 2.4.9-2026-jul
No fix on 2.4.9.x yet
No fix on 2.4.8.5.x yet
No fix on 2.4.7.10.x yet
No fix on 2.4.6.15.x yet

Adobe Commerce Events

On 1.xUpgrade to Adobe Commerce Events 1.21.0
No fix on 1.20.x yet

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 20:18 UTC
Fixed in: Adobe Commerce 2.4.9-2026-jul
Adobe Commerce 2.4.8-2026-jul
Adobe Commerce 2.4.7-2026-jul
Adobe Commerce 2.4.6-2026-jul
Adobe Commerce 2.4.5-2026-jul
Adobe Commerce 2.4.4-2026-jul
Adobe Commerce B2B 1.5.3-2026-jul
Adobe Commerce B2B 1.5.2-2026-jul
Adobe Commerce B2B 1.4.2-2026-jul
Adobe Commerce B2B 1.3.4-2026-jul
Adobe Commerce B2B 1.3.3-2026-jul
Magento Open Source 2.4.9-2026-jul
Magento Open Source 2.4.8-2026-jul
Magento Open Source 2.4.7-2026-jul
Magento Open Source 2.4.6-2026-jul
Adobe Commerce Events 1.21.0
Identifiers: CVE-2026-48356
CVSS: 9.3
KEV deadline: 2026-11-10
Source: CISA KEV
On the menu as: Magento

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Severity: critical, exploited in the wild. Patch status: patched.
Affected: Adobe Commerce
Fixed in: Adobe Commerce 2.4.9-2026-jul, Adobe Commerce 2.4.8-2026-jul, Adobe Commerce 2.4.7-2026-jul, Adobe Commerce 2.4.6-2026-jul, Adobe Commerce 2.4.5-2026-jul, Adobe Commerce 2.4.4-2026-jul, Adobe Commerce B2B 1.5.3-2026-jul, Adobe Commerce B2B 1.5.2-2026-jul, Adobe Commerce B2B 1.4.2-2026-jul, Adobe Commerce B2B 1.3.4-2026-jul, Adobe Commerce B2B 1.3.3-2026-jul, Magento Open Source 2.4.9-2026-jul, Magento Open Source 2.4.8-2026-jul, Magento Open Source 2.4.7-2026-jul, Magento Open Source 2.4.6-2026-jul, Adobe Commerce Events 1.21.0
Ids: CVE-2026-48356

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Added to CISA KEV on 2026-10-27 (federal deadline 2026-11-10).

## Steps
1. Search the repo, its CI and infra config for Adobe Commerce. If present, report the version in use and whether it's affected.
2. Fix by release line: Adobe Commerce: 2.4.9-2026-jul; <= 2.4.9 → no fix on 2.4.9.x yet; 2.4.8-2026-jul; <= 2.4.8-p5 → no fix on 2.4.8.5.x yet; 2.4.7-2026-jul; <= 2.4.7-p10 → no fix on 2.4.7.10.x yet; 2.4.6-2026-jul; <= 2.4.6-p15 → no fix on 2.4.6.15.x yet; 2.4.5-2026-jul; <= 2.4.5-p17 → no fix on 2.4.5.17.x yet; 2.4.4-2026-jul; <= 2.4.4-p18 → no fix on 2.4.4.18.x yet. Adobe Commerce B2B: 1.5.3-2026-jul; <= 1.5.3 → no fix on 1.5.3.x yet; 1.5.2-2026-jul; <= 1.5.2-p5 → no fix on 1.5.2.5.x yet; 1.4.2-2026-jul; <= 1.4.2-p10 → no fix on 1.4.2.10.x yet; 1.3.4-2026-jul; <= 1.3.4-p17 → no fix on 1.3.4.17.x yet; 1.3.3-2026-jul; <= 1.3.3-p18 → no fix on 1.3.3.18.x yet. Magento Open Source: 2.4.9-2026-jul; <= 2.4.9 → no fix on 2.4.9.x yet; 2.4.8-2026-jul; <= 2.4.8-p5 → no fix on 2.4.8.5.x yet; 2.4.7-2026-jul; <= 2.4.7-p10 → no fix on 2.4.7.10.x yet; 2.4.6-2026-jul; <= 2.4.6-p15 → no fix on 2.4.6.15.x yet. Adobe Commerce Events: 1.21.0; <= 1.20.0 → no fix on 1.20.x yet.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Adobe Commerce | fixed | 2.4.9-2026-jul | — |
| Adobe Commerce <= 2.4.9 | migrate | move to 2.4.9-2026-jul | restrict network access to it |
| Adobe Commerce | fixed | 2.4.8-2026-jul | — |
| Adobe Commerce <= 2.4.8-p5 | migrate | move to 2.4.8-2026-jul | restrict network access to it |
| Adobe Commerce | fixed | 2.4.7-2026-jul | — |
| Adobe Commerce <= 2.4.7-p10 | migrate | move to 2.4.7-2026-jul | restrict network access to it |
| Adobe Commerce | fixed | 2.4.6-2026-jul | — |
| Adobe Commerce <= 2.4.6-p15 | migrate | move to 2.4.6-2026-jul | restrict network access to it |
| Adobe Commerce | fixed | 2.4.5-2026-jul | — |
| Adobe Commerce <= 2.4.5-p17 | migrate | move to 2.4.5-2026-jul | restrict network access to it |
| Adobe Commerce | fixed | 2.4.4-2026-jul | — |
| Adobe Commerce <= 2.4.4-p18 | migrate | move to 2.4.4-2026-jul | restrict network access to it |
| Adobe Commerce B2B | fixed | 1.5.3-2026-jul | — |
| Adobe Commerce B2B <= 1.5.3 | migrate | move to 1.5.3-2026-jul | restrict network access to it |
| Adobe Commerce B2B | fixed | 1.5.2-2026-jul | — |
| Adobe Commerce B2B <= 1.5.2-p5 | migrate | move to 1.5.2-2026-jul | restrict network access to it |
| Adobe Commerce B2B | fixed | 1.4.2-2026-jul | — |
| Adobe Commerce B2B <= 1.4.2-p10 | migrate | move to 1.4.2-2026-jul | restrict network access to it |
| Adobe Commerce B2B | fixed | 1.3.4-2026-jul | — |
| Adobe Commerce B2B <= 1.3.4-p17 | migrate | move to 1.3.4-2026-jul | restrict network access to it |
| Adobe Commerce B2B | fixed | 1.3.3-2026-jul | — |
| Adobe Commerce B2B <= 1.3.3-p18 | migrate | move to 1.3.3-2026-jul | restrict network access to it |
| Magento Open Source | fixed | 2.4.9-2026-jul | — |
| Magento Open Source <= 2.4.9 | migrate | move to 2.4.9-2026-jul | restrict network access to it |
| Magento Open Source | fixed | 2.4.8-2026-jul | — |
| Magento Open Source <= 2.4.8-p5 | migrate | move to 2.4.8-2026-jul | restrict network access to it |
| Magento Open Source | fixed | 2.4.7-2026-jul | — |
| Magento Open Source <= 2.4.7-p10 | migrate | move to 2.4.7-2026-jul | restrict network access to it |
| Magento Open Source | fixed | 2.4.6-2026-jul | — |
| Magento Open Source <= 2.4.6-p15 | migrate | move to 2.4.6-2026-jul | restrict network access to it |
| Adobe Commerce Events | fixed | 1.21.0 | — |
| Adobe Commerce Events <= 1.20.0 | migrate | move to 1.21.0 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-48356") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-48356 https://www.adobe.com/trust/security/products/commerce/apsb26-73.html https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://pwned.coffee/i/adobe-commerce-and-magento-unrestricted-upload-of-file-w-cve-2026-48356

Timeline

27 Oct 2026, 20:18 UTC
Fix status: unknown → patched.
27 Oct 2026, 20:18 UTC
Added to CISA's Known Exploited Vulnerabilities catalog.
27 Oct 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-48356 added to CISA KEV on 2026-10-27, federal deadline 2026-11-10.” source
Fix by release line: Product Affected Fixed in Source
Adobe Commerce before 2.4.9-2026-jul 2.4.9-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.9 no fix on 2.4.9.x yet CVE record (CNA) checked 27 Oct
Adobe Commerce before 2.4.8-2026-jul 2.4.8-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.8-p5 no fix on 2.4.8.5.x yet CVE record (CNA) checked 27 Oct
Adobe Commerce before 2.4.7-2026-jul 2.4.7-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.7-p10 no fix on 2.4.7.10.x yet CVE record (CNA) checked 27 Oct
Adobe Commerce before 2.4.6-2026-jul 2.4.6-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.6-p15 no fix on 2.4.6.15.x yet CVE record (CNA) checked 27 Oct
Adobe Commerce before 2.4.5-2026-jul 2.4.5-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.5-p17 no fix on 2.4.5.17.x yet CVE record (CNA) checked 27 Oct
Adobe Commerce before 2.4.4-2026-jul 2.4.4-2026-jul CVE record (CNA) checked 27 Oct
Adobe Commerce <= 2.4.4-p18 no fix on 2.4.4.18.x yet CVE record (CNA) checked 27 Oct
Score: CVSS 9.3 (critical). CVSS 3.1 9.3 (NVD) for CVE-2026-48356
Last checked: 27 Oct 2026, 20:18 UTC

Product	Affected	Fixed in	Source
Adobe Commerce	before 2.4.9-2026-jul	2.4.9-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.9	no fix on 2.4.9.x yet	CVE record (CNA) checked 27 Oct
Adobe Commerce	before 2.4.8-2026-jul	2.4.8-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.8-p5	no fix on 2.4.8.5.x yet	CVE record (CNA) checked 27 Oct
Adobe Commerce	before 2.4.7-2026-jul	2.4.7-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.7-p10	no fix on 2.4.7.10.x yet	CVE record (CNA) checked 27 Oct
Adobe Commerce	before 2.4.6-2026-jul	2.4.6-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.6-p15	no fix on 2.4.6.15.x yet	CVE record (CNA) checked 27 Oct
Adobe Commerce	before 2.4.5-2026-jul	2.4.5-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.5-p17	no fix on 2.4.5.17.x yet	CVE record (CNA) checked 27 Oct
Adobe Commerce	before 2.4.4-2026-jul	2.4.4-2026-jul	CVE record (CNA) checked 27 Oct
Adobe Commerce	<= 2.4.4-p18	no fix on 2.4.4.18.x yet	CVE record (CNA) checked 27 Oct

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee