CVE-2026-48356

Think of this like a mail slot that's supposed to only accept letters, but someone found a way to slip in a disguised package if they trick an employee into clicking a bad link. Once that package is 'delivered,' it can run harmful commands and take control of the employee's account on your store. It needs someone to click something first — it doesn't happen automatically.

This matters to you if you run Adobe Commerce, Magento Open Source, Adobe Commerce B2B, or use the Adobe Commerce Events / I/O Events module. It only becomes a real risk if a logged-in admin or user is tricked into visiting a malicious link or compromised page while using your store's backend.

No attackers are currently exploiting this in the wild, and no public exploit code exists, so this is not an active fire — but the flaw is serious enough that it deserves prompt attention rather than being put on a long to-do list. Patch within your normal update cycle for critical vendor fixes, don't delay indefinitely.

Confirm exposure by identifying your exact Adobe Commerce/Magento/B2B/Events module version against the affected ranges. Apply the July 2026 patches per branch: core Adobe Commerce/Magento Open Source 2.4.4–2.4.9 (target the matching -2026-jul release), Adobe Commerce B2B 1.3.3–1.5.3 (target the matching -2026-jul release), and Adobe Commerce Events / I/O Events before 1.21.0 (upgrade to 1.21.0). Follow Adobe's advisory APSB26-73 for the exact upgrade path and any module dependency notes, as Commerce patches can have interdependencies between core and B2B/Events modules. As a temporary mitigation while scheduling the patch, restrict admin panel access by IP allowlisting and train admin users to avoid clicking unsolicited links (since exploitation requires user interaction and scope change via a crafted URL). Since this is not in CISA KEV and EPSS is low (1.0%, falling trend), there is no regulatory deadline, but monitor Adobe's security bulletins and your WAF/admin logs for anomalous file upload attempts post-patch.

CVSS 9.3 (Critical), AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N — network-exploitable, low complexity, no privileges required, but requires user interaction, with changed scope enabling escalation and high confidentiality/integrity impact without availability impact. Weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type), enabling arbitrary code execution in the victim's session context. Not in CISA KEV; no public exploit code; EPSS at 1.0% (63rd percentile, trending down) indicates low predicted near-term exploitation likelihood. Press attention is sustained but driven by the patch release, not confirmed in-the-wild activity — exploit maturity remains theoretical/PoC-absent at this time.