Adobe Commerce file upload RCE actively exploited (CVE-2026-48356) [PoC]

Actively exploited in the wild - CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce that allows attackers to upload dangerous file types and execute arbitrary code in the context of the current user, potentially seizing control of the victim’s account or session. Adobe has classified this as critical (CVSS 9.3) and confirmed exploitation; apply the vendor patch immediately.

Overview

Adobe Commerce, the ecommerce platform formerly known as Magento, fails to properly restrict the types of files users can upload. An attacker can craft a malicious file, host it behind a crafted URL or compromised web page, and convince a victim to interact with it. Because the upload restriction is missing, the dangerous file is accepted and processed by the server.

The CVSS vector tells the operational story clearly: network attack vector, low complexity, no privileges required, but user interaction is required. The attacker does not need an account. They need one click from someone inside the storefront, admin panel, or a related session. The scope is changed, meaning the compromise can move beyond the original security context and reach the broader application or hosting environment. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, and EPSS estimates a 30.6% probability of exploitation in the next 30 days.

What the impact is

Successful exploitation grants arbitrary code execution in the context of the current user. For a storefront user that means session hijacking and account takeover. For an administrator it means control over storefront configuration, customer data, order records, and payment flows. Because scope is changed, an attacker who lands code execution can pivot toward the underlying host or adjacent services. Commerce platforms hold customer PII and payment-adjacent data, so the downstream risk includes data breach exposure, not just site defacement.

Remediation and mitigation

• Apply Adobe’s security bulletin update for Adobe Commerce immediately. Confirm the exact patched release in Adobe’s advisory for CVE-2026-48356 and test in staging before pushing to production.
• Restrict file upload functionality to authenticated, trusted users and lock down accepted file extensions and MIME types at the web server layer where possible.
• Enforce the admin panel behind a VPN or IP allowlist, and require phishing-resistant MFA for all admin accounts.
• Review logs for unusual uploads, new files in web-accessible directories, and unexpected outbound connections from the Commerce host.
• Treat any storefront session that interacted with a suspicious link as compromised: rotate credentials, invalidate sessions, and audit recent admin changes.
• For ongoing tracking, follow security news and review breach reports if you suspect data exposure.

Security Insight

Adobe Commerce inherits Magento’s long history of upload and deserialization flaws, and this case shows the pattern has not been designed out: a missing type check on an upload path remains a direct path to code execution. The more telling signal is the KEV listing so soon after disclosure. Ecommerce platforms are high-value and internet-facing, and attackers are clearly pre-positioning exploits rather than waiting for mass scanning. Merchants who treat patch cadence as an infrastructure chore rather than a revenue-protection control will keep funding this cycle.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs