Priority alerts and briefings from Radar, by email.
Checking availability…
Security advisory
Adobe Commerce and Magento: verify the July security patch
CISA lists CVE-2026-48356 as exploited. Verify the July security fix for your installed edition, release branch and components; a compatible base version alone does not prove the patch is applied.
Who should check: Teams operating Adobe Commerce or Magento Open Source and their installed B2B or Events components.
Recommended actionFix available
Verify the matching July security patch is applied, including fixes delivered through cloud-patches; investigate suspected compromise.
CVE-2026-48356 concerns unrestricted file upload in Adobe Commerce and Magento. The Adobe CNA describes potential code execution in the current user context and requires the victim to visit a crafted URL or interact with a compromised page. CISA added the CVE to KEV on October 27; that date is not the start of exploitation.
Adobe released the security update on July 14. Its installation guidance provides isolated patches matched to the release branch and installed components. A prerequisite base version is not the isolated security fix. Verify actual application using Adobe's documented tooling and deployment records. Cloud-patches may already supply the fix; applying the isolated patch again can fail.
The sources differ on CVSS and the lower bound of affected Events versions. APSB26-73 gives 9.6, while Adobe's CNA gives 9.3. The bulletin lists Events 1.6.0–1.20.0, while the CNA includes earlier versions. Both list Events 1.21.0 as corrected. No single score or resolved lower bound is asserted here; confirm uncertain installations with Adobe.
The older bulletin's statement that Adobe was unaware of attacks predates the October 27 KEV listing. CISA's later evidence applies to this exact CVE, not every issue in APSB26-73, and does not establish compromise of your store. Its federal due date is not a universal customer deadline.
Vendor / publisher
Adobe
Vulnerability identifiers
CVE-2026-48356
Access required
Application or configuration dependent
Disclosed
Jul 14, 2026
Latest evidence check
Oct 28, 2026 UTC
Which systems and versions are affected?
Product
Affected
Fixed release / action
Adobe Commerce
APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier. These base levels are not proof that the isolated fix is applied.
Applicable July 2026 isolated security patch for the installed branch and components; verify application, including delivery through cloud-patches.
Magento Open Source
APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier. Do not infer that unsupported releases are safe.
Applicable July 2026 isolated security patch for the installed branch and components; verify application.
Adobe Commerce B2B
APSB26-73 lists 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, and 1.3.3-p18 and earlier.
Applicable July 2026 B2B component patch, with the required CE/EE patches for the installation.
Adobe Commerce Events
Affected range requires clarification: APSB26-73 lists 1.6.0–1.20.0; the CNA record lists versions through 1.20.0 with a different lower bound. Confirm older versions with Adobe.
1.21.0 (listed by both Adobe sources)
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
The sources reviewed here establish known exploitation through CISA KEV; they do not establish a public research demonstration. These are separate evidence questions.
CISA added CVE-2026-48356 to KEV on October 27. The CNA describes user interaction as required. Verify that the applicable security fix is installed; a supported base release alone is insufficient.
What does this mean for AI environments?
If commerce integrations or agent tools access the deployment, include their reachable data and credentials in the investigation. The reviewed sources do not establish an AI-specific attack.
Initial coverage following the October 27 CISA KEV addition. Original disclosure was July 14. Distinguished patch prerequisites from installed remediation and retained source discrepancies.
Response actions
Plan your response
0 of 4 actions recorded as done
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
1
Identify the installed edition and components
Record the Commerce or Magento release branch and patch level, edition, installed B2B and Events versions, and deployment model. Match each component to Adobe’s guidance.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
2
Verify the security fix, not just the version
Check whether the matching July isolated security patch is applied. Upgrade to the prerequisite base level when needed, then apply the matching component files. Check cloud-patches first to avoid applying an already incorporated fix twice.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3
Confirm the deployed patch state
Use Adobe’s documented verification tooling and deployment records to confirm patch application in the running environment. Preserve the evidence for each deployment; an eligible version or downloaded patch does not establish installation.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
4
Investigate suspected compromise
Preserve relevant application and access logs and review unexpected changes or account activity. Installing the fix does not establish that an earlier compromise did not occur.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
Product
Affected
Fixed release / action
Adobe Commerce
APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier. These base levels are not proof that the isolated fix is applied.
Applicable July 2026 isolated security patch for the installed branch and components; verify application, including delivery through cloud-patches.
Magento Open Source
APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier. Do not infer that unsupported releases are safe.
Applicable July 2026 isolated security patch for the installed branch and components; verify application.
Adobe Commerce B2B
APSB26-73 lists 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, and 1.3.3-p18 and earlier.
Applicable July 2026 B2B component patch, with the required CE/EE patches for the installation.
Adobe Commerce Events
Affected range requires clarification: APSB26-73 lists 1.6.0–1.20.0; the CNA record lists versions through 1.20.0 with a different lower bound. Confirm older versions with Adobe.
1.21.0 (listed by both Adobe sources)
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Access requiredApplication or configuration dependent
TRACEABLE EVIDENCE
Evidence & sources
Checked Oct 28, 2026 UTC
Why this priority
CISA added CVE-2026-48356 to KEV on October 27. The CNA describes user interaction as required. Verify that the applicable security fix is installed; a supported base release alone is insufficient.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Sources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
The sources reviewed here establish known exploitation through CISA KEV; they do not establish a public research demonstration. These are separate evidence questions.
If commerce integrations or agent tools access the deployment, include their reachable data and credentials in the investigation. The reviewed sources do not establish an AI-specific attack.