Adobe Commerce APSB26-73 fixes exploited file upload flaw CVE-2026-48356 and related issues

What happened

Adobe's July 2026 security bulletin covers ten vulnerabilities across Adobe Commerce, Magento Open Source, Adobe Commerce B2B and Adobe Commerce Events. The most serious, CVE-2026-48356, is an unrestricted upload of a file with a dangerous type. An attacker can achieve arbitrary code execution in the context of the current user after a victim visits a maliciously crafted URL or interacts with a compromised page. CISA KEV records this CVE as exploited; Adobe has not said whether exploitation details have been publicly disclosed.

Other flaws in the same bulletin include improper output encoding (CVE-2026-48358) and SQL injection (CVE-2026-47992) that could allow code execution for high-privileged attackers without user interaction, stored cross-site scripting (CVE-2026-47994, CVE-2026-47995), incorrect authorization flaws (CVE-2026-47988, CVE-2026-47984, CVE-2026-47997, CVE-2026-47996) that could lead to security feature bypass and unauthorized read or limited write access, and an open redirect (CVE-2026-48000). The most severe authorization issue requiring no credentials is CVE-2026-47988.

Who is affected

Adobe Commerce versions up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, and 2.4.4-p18 are affected. Adobe Commerce B2B versions up to and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, and 1.3.3-p18 are affected. Magento Open Source up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, and 2.4.6-p15 is affected. Adobe Commerce Events up to and including 1.20.0 is affected. These are typically customer-facing storefront and order management deployments, often internet-exposed.

What to do now

1. Apply the fixed builds from Adobe's APSB26-73 bulletin. For Adobe Commerce, use 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul. For Adobe Commerce B2B, use 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul. For Magento Open Source, use 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul or 2.4.6-2026-jul. For Adobe Commerce Events, use 1.21.0.
2. Treat CVE-2026-48356 as a priority: CISA KEV lists it as exploited and gives a due date of 10 November 2026. Apply mitigations in line with CISA's BOD 26-04 guidance, and if mitigations are unavailable, discontinue use or follow cloud service guidance.
3. Identify internet-facing storefronts and admin panels. Restrict access to trusted networks until patching is complete.
4. Watch for unusual admin or checkout activity after patching.

Beyond the patch

Because CISA KEV already records CVE-2026-48356 as exploited, detection and response should sit alongside the patch, not after it. Managed Detection & Response can watch storefront and admin behaviour for post-exploitation activity, and an Incident Response Retainer shortens the time to contain an account or checkout compromise. For shops that cannot patch immediately, Virtual CISO Services can help map internet-facing exposure against BOD 26-04 obligations.