compromised.live Free. No login.
Feed / CVE-2026-48356Also as JSON
ACT NOWExploited vulnerability Adobe Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

What's happening and what to do

Attackers can upload dangerous file types to the store and run their own code, potentially taking over accounts or sessions. This flaw is being actively exploited. Adobe Commerce and Magento. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files or unfamiliar admin activity.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

  1. 2026-10-27Added to CISA's Known Exploited Vulnerabilities catalog.
  2. 2026-11-03 21:55First seen here.
  3. 2026-11-10Federal patch deadline for US agencies.

Source text

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.