Protego field desk
PROTEGO
← CVE Lookup

CVE-2026-48356

CRITICALCVSS 3.1 · 9.3 · NIST NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CISA KEV: known exploited

Added: 2026-10-27 · Due: 2026-11-10

Known ransomware use: Unknown

EPSS: 30.58% · Percentile: 98.2%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-434 · Published: 2026-07-14T20:17:08.437 · Modified: 2026-10-27T20:17:14.683

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 3.1: 9.3 (CRITICAL) · NIST NVD
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
  • CVSS 3.1: 9.3 (CRITICAL) · psirt@adobe.com
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References and fixes