Our automated tracking framework flagged that CISA added CVE-2026-48356 (Adobe Commerce and Magento) to the Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-48356 by November 10, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-48356 |
| Vendor / product | Adobe Commerce and Magento |
| Vulnerability | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability |
| CVSS base score | 9.3 |
| Added to KEV | October 27, 2026 |
| Days public before listing (NVD → KEV lag) | 105 |
| Federal patch deadline | November 10, 2026 |
| Known ransomware use | No |
How This Compares to Adobe’s Track Record
This one was public for just 105 days before CISA confirmed exploitation — faster than Adobe’s 2515-day median, meaning attackers moved unusually quickly. Adobe currently ranks #3 on our KEV Lag leaderboard.
| Adobe in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 83 |
| Median lag (public → KEV listing) | 2515 days |
| 0-day rate (exploited at or before disclosure) | 4% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1760 tracked KEV entries is 237 days — Adobe’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Adobe KEV Additions
The most recent Adobe vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-71362 | Commerce and Magento | September 24, 2026 | 44 | No |
| CVE-2026-75650 | Commerce and Magento | September 8, 2026 | 1 | No |
| CVE-2026-48282 | ColdFusion | July 7, 2026 | 7 | No |
| CVE-2009-3459 | Acrobat and Reader | May 20, 2026 | 6063 | No |
| CVE-2020-9715 | Acrobat | April 13, 2026 | 2063 | No |
Related Coverage
- Adobe’s CVE-2026-75650 Was Exploited in 1 Days — Well Under Its 2627-Day Median (September 2026)
- Adobe’s CVE-2026-71362 Was Exploited in 44 Days — Faster Than Its 2571-Day Median (September 2026)
What This Means for Defenders
CISA has added CVE-2026-48356, an Adobe Commerce and Magento vulnerability with a CVSS base score of 9.3, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw poses a critical risk, primarily to organizations using Adobe Commerce or Magento platforms. The federal patch deadline is November 10, 2026, making it urgent for security teams to prioritize applying updates. Successful exploitation could lead to significant system compromise.
This vulnerability was public for 105 days before its KEV listing on 2026-10-27, which indicates a relatively rapid transition from public disclosure to confirmed in-the-wild exploitation. While not currently linked to ransomware, its demonstrated exploitability warrants urgent attention.
If you can’t apply the patch before November 10, 2026, restrict access to the affected environment. Additionally, strengthen web application firewalls (WAFs) to detect and block malicious file uploads, implement strict file type and content validation, and enhance monitoring for unusual activity originating from the Adobe Commerce/Magento environment.
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
