Magento and Adobe Commerce flaw now used in attacks

If your online shop runs on Magento Open Source or Adobe Commerce, check that the July 2026 security update is installed. The US cyber agency CISA added the flaw, CVE-2026-48356, to its list of exploited vulnerabilities on 27 October 2026. Adobe fixed it on 14 July in bulletin APSB26-73, so shops that are behind on updates are the ones at risk.

What is the problem?

The flaw lets someone upload a file of a dangerous type to the shop. According to the official description, this can lead to the attacker running code on the site and taking over a victim's account or session. The victim has to open a specially made link or page for the attack to work. Adobe rates it Critical, with a score of 9.3 out of 10.

On an online shop, someone else's code running on the site puts orders, payment pages and customer details at risk.

Which versions are affected?

The US National Vulnerability Database lists these as affected:

• Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier
• Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier releases of each line
• Adobe Commerce B2B extension 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier

What to do

1. Find your version in the Magento admin, at the bottom of the dashboard, or ask your developer.
2. Ask your developer to install the security update from Adobe bulletin APSB26-73 or any newer one, after a full backup of the files and database.
3. If the update was late, have the developer look for unknown files in the media and upload folders and for new admin users.
4. Change the admin passwords and turn on two-step login for every admin account.
5. If your shop is on an old Magento line that no longer gets updates, plan the upgrade now.

The flaw is in Magento itself. Shops on other platforms, such as WooCommerce or Shopify, are not on the affected list.

How SyncTech can help

For shops on WordPress and WooCommerce, our care plan for online shops covers testing and applying security updates.

Source and credit

We are sharing this news from CISA, the US National Vulnerability Database and Adobe. This summary is written by Synctech in our own words.

• Known Exploited Vulnerabilities Catalog, entry CVE-2026-48356 (added 27 October 2026), CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
• CVE-2026-48356 detail, NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-48356
• Security update available for Adobe Commerce, APSB26-73, Adobe, 14 July 2026: https://helpx.adobe.com/security/products/magento/apsb26-73.html

Retrieved 28 October 2026. Adobe, Adobe Commerce, Magento, WooCommerce and Shopify are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.