VulnSocial

CVE-2026-48356PoC(adobe / commerce)

MEDIUMCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Prioritize remediation for adobe commerce systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

adobe CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • commerce
  • commerce_b2b
  • i\/o_events
  • magento

Threat summary

  • Public PoC and exploit tooling are both present
  • 7 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 4 signals
  • Technical details provided in 6 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 3 mentions on most recent observed day (2026-09-28)
  • 7 total mentions across 5 days

Affected systems

Vendors
adobe
Products
commercecommerce_b2bi\/o_eventsmagento

11 versions affected across 4 products

Deep dive

Activity timeline7 mentions / 5d
01223Mentions · 2026-07-14: 1Mentions · 2026-07-15: 1Mentions · 2026-07-16: 1Mentions · 2026-09-26: 1Mentions · 2026-09-28: 3PoC Mentioned / Linked · 2026-09-26: 1PoC Mentioned / Linked · 2026-09-28: 3Exploit Tool / Code · 2026-09-28: 1Technical Details · 2026-07-14: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-16: 1Technical Details · 2026-09-26: 1Technical Details · 2026-09-28: 207-1407-1507-1609-2609-28
Signal classification3 categories
PoC
457.1%
General
228.6%
Disclosure
114.3%
Referenced assets10 URLs
Classification over time
DateTotalLabels
2026-07-141
General1
2026-07-151
Disclosure1
2026-07-161
General1
2026-09-261
PoC1
2026-09-283
PoC3
Full discourse7 posts
  • abraxas@abraxas_null
    PoC

    @exploitgrid poc is here, for interested parties: https://github.com/abraxas/CVE-2026-48356

    Post summary

    The tweet shares a Proof of Concept for CVE-2026-48356 via a GitHub link, with no exploit code, active exploitation, or patch information.

    0005176
    320 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    🚨 PoC for CVE-2026-48356 is now public. Adobe Commerce has an unrestricted file upload flaw that can lead to arbitrary code execution in the context of the current user. CVSS 9.3 | Public exploit ExploitGrid: 45.6/100 Medium 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-48356

    Post summary

    A PoC for CVE‑2026‑48356 has been released, exposing an unrestricted file upload flaw in Adobe Commerce that enables arbitrary code execution (CVSS 9.3).

    21030215
    385 followersView on X
  • にゃん☆たく/takumi.a@taku888infinity
    General

    今日のパッチチューズデー（MS一旦割愛） ◆Ivanti（クリティカルなし） CVE-2026-14903　Xtractionのパストラバーサルで任意ファイル読取 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-CVE-2026-14902-CVE-2026-14903?l… ◆Fortinet（クリティカルなし） CVE-2025-53379　FortiAuthenticator GUIの境界外読取り CVE-2026-59835　FortiSandboxのVNC無認証アクセス https://www.fortiguard.com/psirt?filter=1&version=&severity=5&severity=4&severity=3&severity=2 ◆SAP CVE-2026-44747　NetWeaver ABAPのメモリ破損で任意コード実行恐れ CVE-2026-27690　SAP ApprouterのHTTPリクエストスマグリング CVE-2026-44761　Commerce Cloudのサンプル認証情報が残存 CVE-2026-40128　NetWeaver Javaのディレクトリトラバーサル https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html ◆Adobe（今日多すぎ） Adobe ColdFusion（APSB26-82） CVE-2026-48318：パストラバーサルによる任意コード実行  CVE-2026-48322：コードインジェクションによる任意コード実行 CVE-2026-48284：入力検証不備による任意コード実行 CVE-2026-48321：認可不備による権限昇格 CVE-2026-48325：認証不備による任意コード実行  CVE-2026-48319：パストラバーサルによる任意コード実行  CVE-2026-48324：SQLインジェクションによる任意コード実行  CVE-2026-48327：認可不備による任意コード実行 CVE-2026-48320：反射型XSSによる権限昇格  CVE-2026-48328：入力検証不備による保護機能回避  CVE-2026-48332：SSRFによる保護機能回避  CVE-2026-48338：パストラバーサルによる任意ファイル読取 Adobe Commerce（APSB26-73） CVE-2026-48356：危険ファイルアップロードによる権限昇格 CVE-2026-48358：出力処理不備による任意コード実行 CVE-2026-47994：格納型XSSによる権限昇格 CVE-2026-47988：認可不備による保護機能回避 CVE-2026-47984：認可不備による保護機能回避 CVE-2026-47995：B2B機能の格納型XSSによる権限昇格 CVE-2026-47996：認可不備による保護機能回避 CVE-2026-47992：入力検証不備による権限昇格 Adobe Experience Manager（APSB26-74） CVE-2026-48259：SSRFによる任意コード実行 CVE-2026-48359：XXEによる任意コード実行 CVE-2026-48252：認証不備による保護機能回避 CVE-2026-48310：パストラバーサルによる任意読取 https://helpx.adobe.com/security.html

    Post summary

    The post enumerates multiple CVEs with brief technical descriptions and vendor advisory links, but it does not mention PoCs, exploits, active use, or patch specifics.

    000421.6K
    11.8K followersView on X
  • abraxas@abraxas_null
    PoC

    A double-whammy on Adobe Magento! CVE-2026-75650 - Adobe Magento - Critical 10.0 - Unauthenticated Remote Code Execution https://github.com/abraxas/CVE-2026-75650 CVE-2026-48356 - Magento - Critical 9.3 - Unauthenticated Unrestricted File Upload https://github.com/abraxas/CVE-2026-48356 https://t.co/yjkrCzz7Xc

    Post summary

    The text discloses two critical Adobe Magento vulnerabilities with technical details and CVSS scores, linking to GitHub repositories that imply PoC availability, but does not confirm functional exploit code, active exploitation, or patches.

    0001297
    151 followersView on X
  • dbugs@ptdbugs
    PoC

    A PoC/exploit has been discovered for vulnerability CVE-2026-48356 PT ID: PT-2026-58797 Vendor: Adobe Product: Adobe Commerce Description: Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. References: • https://dbu.gs/vulnerability/PT-2026-58797 • https://github.com/abraxas/cve-2026-48356

    Post summary

    A PoC/exploit for CVE‑2026‑48356 has been disclosed, showing an unrestricted file upload in Adobe Commerce that can lead to arbitrary code execution; no patch or active exploitation is reported.

    00010484
    3.7K followersView on X
  • NotCVE@notCVE
    General

    🎯 Most likely to be exploited next (EPSS): • CVE-2026-48356 — EPSS 28.3% · CVSS 9.6 • CVE-2026-50522 — EPSS 19.7% · CVSS 9.8 • CVE-2026-47992 — EPSS 19.6% · CVSS 7.2 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-07-16.md

    Post summary

    The post enumerates three CVEs with their EPSS and CVSS scores, highlighting those considered most likely to be exploited soon, and links to a broader weekly report for details.

    0000067
    60 followersView on X
  • The Circuitry@thecircuitry_
    Disclosure

    Adobe Commerce is affected by critical vulnerability CVE-2026-48356, CVSS 9.6, that allows arbitrary code execution via unrestricted file uploads requiring user interaction.

    Post summary

    Adobe Commerce is publicly disclosed to have a critical CVE-2026-48356 vulnerability with a CVSS of 9.6, enabling arbitrary code execution through unrestricted file uploads that require user interaction.

    0000038
    26 followersView on X
CPE platform detail171 entries

171 of 171 entries

PartVendorProductVersionTarget SWTarget HW
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.4--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.5--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.6--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.7--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.8--
Appadobecommerce2.4.9--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.3--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.3.4--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.4.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.2--
Appadobecommerce_b2b1.5.3--
Appadobei\/o_events-commerce-
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.6--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.7--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.8--
Appadobemagento2.4.9--

Explore more

Back to dashboardadobe CVEscommerce vulnerabilities