CVE-2026-48356 is a critical-severity vulnerability. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

This vulnerability affects the following products and versions:

Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier – (Affected)
Adobe Commerce B2B 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier – (Affected)
Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier – (Affected)
Adobe Commerce Events 1.6.0 through 1.20.0 – (Affected)

An attacker may exploit this vulnerability by leveraging insecure file upload functionality within vulnerable Adobe Commerce or Magento environments.

Step 1 - Identify a Vulnerable Commerce Instance

The attacker identifies an internet-facing Adobe Commerce or Magento application running a vulnerable version.

Step 2 - Upload of Malicious File

The attacker abuses a file-upload feature and submits a crafted malicious file disguised as a legitimate upload.

Step 3 - Trigger User Interaction

The attacker persuades a victim to visit a malicious URL or interact with a compromised webpage that triggers the vulnerability.

Step 4 - Execute Malicious Code

The uploaded file executes within the context of the affected application or user session, potentially leading to privilege escalation and unauthorized access.

Step 5 - Compromise the Environment

The attacker may gain access to user accounts, administrative sessions, sensitive information, or additional systems connected to the application.

CERTVU recommends the following:

1. Upgrade Immediately

   Upgrade affected systems to the latest security releases provided by Adobe: Adobe Commerce 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4; Adobe Commerce B2B July 2026 security releases; Adobe Commerce Events 1.21.0.

2. Restrict File Upload Permissions

   Limit upload capabilities to trusted and authenticated users only. Disable unnecessary upload functionality where possible.

3. Implement Web Application Firewall (WAF) Protection

   Deploy WAF rules to block malicious upload attempts and suspicious requests targeting upload endpoints.

4. Monitor for Indicators of Compromise

   Review application and web server logs for unexpected file uploads, suspicious executable files in upload directories, unusual administrative activity, and unauthorized session creation or privilege changes.