# Adobe Commerce and Magento: verify the July security patch Canonical: https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356 Publisher: Oktsec Language: en Published: 2026-10-28T09:42:12Z Updated: 2026-10-28T09:42:12Z Record reviewed: 2026-10-28T09:42:12Z Latest evidence check: 2026-10-28T09:42:12Z Disclosed: 2026-07-14 CISA lists CVE-2026-48356 as exploited. Verify the July security fix for your installed edition, release branch and components; a compatible base version alone does not prove the patch is applied. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA added CVE-2026-48356 to KEV on October 27. The CNA describes user interaction as required. Verify that the applicable security fix is installed; a supported base release alone is insufficient. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Adobe - Products: Adobe Commerce, Magento Open Source, Adobe Commerce B2B, Adobe Commerce Events - CVEs: CVE-2026-48356 ## Technical overview CVE-2026-48356 concerns unrestricted file upload in Adobe Commerce and Magento. The Adobe CNA describes potential code execution in the current user context and requires the victim to visit a crafted URL or interact with a compromised page. CISA added the CVE to KEV on October 27; that date is not the start of exploitation. Adobe released the security update on July 14. Its installation guidance provides isolated patches matched to the release branch and installed components. A prerequisite base version is not the isolated security fix. Verify actual application using Adobe's documented tooling and deployment records. Cloud-patches may already supply the fix; applying the isolated patch again can fail. The sources differ on CVSS and the lower bound of affected Events versions. APSB26-73 gives 9.6, while Adobe's CNA gives 9.3. The bulletin lists Events 1.6.0–1.20.0, while the CNA includes earlier versions. Both list Events 1.21.0 as corrected. No single score or resolved lower bound is asserted here; confirm uncertain installations with Adobe. The older bulletin's statement that Adobe was unaware of attacks predates the October 27 KEV listing. CISA's later evidence applies to this exact CVE, not every issue in APSB26-73, and does not establish compromise of your store. Its federal due date is not a universal customer deadline. ## Recommended response Verify the matching July security patch is applied, including fixes delivered through cloud-patches; investigate suspected compromise. Relevant to: Teams operating Adobe Commerce or Magento Open Source and their installed B2B or Events components. ## CVE attribution - CVE-2026-48356: Adobe — Adobe Commerce, Magento Open Source, Adobe Commerce B2B, Adobe Commerce Events. [Source](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html) ## Exploit demonstration Status: Public demonstration not established CVEs: CVE-2026-48356 Checked: 2026-10-28T09:42:12Z The sources reviewed here establish known exploitation through CISA KEV; they do not establish a public research demonstration. These are separate evidence questions. [Supporting source](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) [Supporting source](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html) ## Affected systems and fixes ### Adobe Commerce Affected: APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier. These base levels are not proof that the isolated fix is applied. Fixed release / action: Applicable July 2026 isolated security patch for the installed branch and components; verify application, including delivery through cloud-patches. ### Magento Open Source Affected: APSB26-73 lists 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier. Do not infer that unsupported releases are safe. Fixed release / action: Applicable July 2026 isolated security patch for the installed branch and components; verify application. ### Adobe Commerce B2B Affected: APSB26-73 lists 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, and 1.3.3-p18 and earlier. Fixed release / action: Applicable July 2026 B2B component patch, with the required CE/EE patches for the installation. ### Adobe Commerce Events Affected: Affected range requires clarification: APSB26-73 lists 1.6.0–1.20.0; the CNA record lists versions through 1.20.0 with a different lower bound. Confirm older versions with Adobe. Fixed release / action: 1.21.0 (listed by both Adobe sources) Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.27 Checked: 2026-10-28T09:44:17.412Z ### [CVE-2026-48356](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356) - Added: 2026-10-27 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-10 - Federal forensic triage: No Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-48356 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Identify the installed edition and components** — Record the Commerce or Magento release branch and patch level, edition, installed B2B and Events versions, and deployment model. Match each component to Adobe’s guidance. 2. **Verify the security fix, not just the version** — Check whether the matching July isolated security patch is applied. Upgrade to the prerequisite base level when needed, then apply the matching component files. Check cloud-patches first to avoid applying an already incorporated fix twice. 3. **Confirm the deployed patch state** — Use Adobe’s documented verification tooling and deployment records to confirm patch application in the running environment. Preserve the evidence for each deployment; an eligible version or downloaded patch does not establish installation. 4. **Investigate suspected compromise** — Preserve relevant application and access logs and review unexpected changes or account activity. Installing the fix does not establish that an earlier compromise did not occur. ## Relevance to AI environments If commerce integrations or agent tools access the deployment, include their reachable data and credentials in the investigation. The reviewed sources do not establish an AI-specific attack. ## Sources - [CISA KEV: CVE-2026-48356, added October 27, 2026](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-10-28T09:42:12Z - [APSB26-73: affected products and July security update](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html) — Adobe; Vendor notice; checked 2026-10-28T09:42:12Z - [July isolated patch installation and cloud-patches guidance](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421) — Adobe; Vendor notice; checked 2026-10-28T09:42:12Z - [Adobe CNA record for CVE-2026-48356](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48356.json) — Adobe CNA; Vendor notice; checked 2026-10-28T09:42:12Z ## Editorial record - 2026-10-28T09:42:12Z: Initial coverage following the October 27 CISA KEV addition. Original disclosure was July 14. Distinguished patch prerequisites from installed remediation and retained source discrepancies. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356) · [Build a response plan](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356#review-workspace) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=adobe-commerce-magento-cve-2026-48356&service=patch_verification) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=adobe-commerce-magento-cve-2026-48356&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.