CISA adds Adobe Commerce and Magento file-upload flaw to exploited list

CISA added CVE-2026-48356, an unrestricted file-upload vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on October 27, 2026. U.S. federal agencies must remediate it by November 10; affected versions and a CVSS score have not yet been published.

• CVE-2026-48356 is an unrestricted upload of dangerous file types enabling code execution
• CISA listed it in KEV on October 27 with a federal due date of November 10
• Adobe Commerce and Magento are affected; versions and patches are in Adobe's bulletin
• CISA marks known ransomware use as Unknown