Adobe Commerce and Magento flaw is being exploited; update now
Original title：CISA KEV added CVE-2026-48356: Adobe Commerce and Magento – Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
What happened
Adobe Commerce and Magento have a flaw that lets attackers upload dangerous files and run arbitrary code. CISA lists it as exploited in the wild, so online stores could be taken over or have admin access hijacked.
Who is affected
- Anyone running a Magento store
- Agencies managing Adobe Commerce sites
What to do
Check Adobe's security bulletin for the fixed version and apply it promptly. Also inspect upload directories for suspicious files.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Commerce / Magento | 要確認 | 要確認 |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：CISA Known Exploited Vulnerabilities ↗
- CVE：CVE-2026-48356 ↗