Adobe Commerce and Connect Code Execution Flaws

What happened

Adobe's advisory identifies critical security flaws affecting Adobe Commerce and Adobe Connect, along with related products and components. Think of the Commerce flaw as a delivery desk accepting a package that contains something it should never have allowed inside: an unsafe file upload could lead to attacker-chosen code running with the affected user's permissions.

CVE-2026-48356 affects Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events. CVE-2026-48360 affects the listed Adobe Connect Desktop and Adobe Connect Mobile applications. Although both flaws can lead to code execution, they involve different weaknesses and require different updates.

CVE-2026-48356 is known to be exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-27, with a due date of 2026-11-10. Its known ransomware use is listed as Unknown; that does not establish whether ransomware operators have used it. The supplied CISA KEV entry concerns the Commerce vulnerability and does not establish exploitation of the Connect vulnerability.

Technical details

NVD classifies CVE-2026-48356 as CWE-434, Unrestricted Upload of File with Dangerous Type. In plain language, the weakness concerns allowing an uploaded file type that can be dangerous when accepted by the application. The described outcome is arbitrary code execution, meaning an attacker could cause code of their choosing to run with the current user's permissions. That could also give the attacker greater access to, or control over, the affected account or session. The description does not identify a particular upload endpoint or explain the internal processing sequence.

CVE-2026-48360 is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'). This describes a failure to keep unintended instructions out of generated code. For the affected Adobe Connect applications, the stated consequence is attacker-chosen code running with the current user's permissions. The available description does not identify the exact code-generation component or establish that the attacker would automatically receive administrator privileges.

Both vulnerabilities require user interaction: a victim must visit a specially crafted URL or interact with a compromised web page. That requirement matters when interpreting the risk; these descriptions do not establish an attack that succeeds merely because an affected application is installed. NVD also marks both vulnerabilities as having changed scope, meaning the security impact can cross the boundary of the vulnerable component.

NVD assigns CVE-2026-48356 a CVSS 3.1 score of 9.3 and CVE-2026-48360 a CVSS 3.1 score of 9.6, both rated CRITICAL. CVSS, the Common Vulnerability Scoring System, describes technical severity; it does not prove that exploitation has occurred. The separate CISA KEV listing provides that evidence for CVE-2026-48356. NVD published the Commerce entry on 2026-07-14 and the Connect entry on 2026-10-27.

Who is affected

Everyday users

For everyday users, the most direct update task is checking any installed Adobe Connect application against the affected version for that device. The advisory covers separate Desktop releases for Mac Intel, Mac Silicon and Windows, plus Adobe Connect Mobile on Android. Each has its own fixed version, so an update number for another platform is not a reliable comparison.

The interaction requirement also makes unexpected links and compromised pages relevant to both flaws. Be cautious about unfamiliar links while arranging the applicable update. If you use a service running Adobe Commerce or Magento Open Source, its maintainers handle the server-side update; an ordinary user cannot confirm that repair from the appearance of a web page.

Developers

Developers maintaining Adobe Commerce or Magento Open Source should match the installed release branch to its specific fixed release. The advisory lists separate targets across several branches. Adobe Commerce B2B and Adobe Commerce Events also have their own affected ranges, so checking only the main Commerce version leaves part of the inventory unanswered.

The weakness categories help explain the repairs, but they are not a substitute for installing them. CWE-434 concerns dangerous upload types, while CWE-94 concerns control over generated code. Neither description provides enough implementation detail to justify a specific custom filter or code change as a complete fix. Follow the update steps in the vendor's advisory and check the resulting deployed versions.

Server and IT admins

Server administrators should prioritize affected Commerce deployments because CVE-2026-48356 has confirmed exploitation in CISA KEV. Include Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events when checking the environment. Record the affected branch and its corresponding fixed target so that a completed update can be verified against the correct row of Adobe's advisory.

IT administrators responsible for user devices should inventory Adobe Connect separately by platform. Mac Intel and Mac Silicon have different affected and fixed releases, and the Windows and Android releases use their own version strings. The shared CVE does not make those update packages or version thresholds interchangeable.

What to do now

1. Identify which listed products are installed and record their current versions. For Adobe Commerce and Magento Open Source, use the allowed version command below as part of that inventory. Check Adobe Commerce B2B, Adobe Commerce Events and Adobe Connect independently where present, then follow the update steps in the vendor's advisory.
2. For Adobe Commerce, match the installed branch to its target: 2.4.4-p18 and earlier → 2.4.4-2026-jul and later; 2.4.5-p17 and earlier → 2.4.5-2026-jul and later; 2.4.6-p15 and earlier → 2.4.6-2026-jul and later; 2.4.7-p10 and earlier → 2.4.7-2026-jul and later; 2.4.8-p5 and earlier → 2.4.8-2026-jul and later; 2.4.9 → 2.4.9-2026-jul and later.
3. For Adobe Commerce B2B, use the corresponding fixed release: 1.3.3-p18 and earlier → 1.3.3-2026-jul and later; 1.3.4-p17 and earlier → 1.3.4-2026-jul and later; 1.4.2-p10 and earlier → 1.4.2-2026-jul and later; 1.5.2-p5 and earlier → 1.5.2-2026-jul and later; 1.5.3 → 1.5.3-2026-jul and later.
4. For Magento Open Source, use the fixed release for the installed branch: 2.4.6-p15 and earlier → 2.4.6-2026-jul and later; 2.4.7-p10 and earlier → 2.4.7-2026-jul and later; 2.4.8-p5 and earlier → 2.4.8-2026-jul and later; 2.4.9 → 2.4.9-2026-jul and later.
5. Update Adobe Commerce Events if its version is >= 1.6.0 and <= 1.20.0. The fixed target is 1.21.0 and later. Check this component even when the main Adobe Commerce installation has already been updated.
6. Update affected Adobe Connect applications using the platform-specific target: Adobe Connect Desktop (Mac Intel), 2026.01.39 and earlier → 2026.10.170 and later; Adobe Connect Desktop (Mac Silicon), 2026.08.45 and earlier → 2026.10.66 and later; Adobe Connect Desktop (Windows), 2026.8.51 and earlier → 2026.9.61 and later; Adobe Connect Mobile (Android), 4.4 and earlier → 4.5 and later.
7. After updating, confirm the versions actually running against the applicable fixed releases in Adobe's advisory. Keep the Commerce remediation prioritized because CISA KEV confirms exploitation of CVE-2026-48356; use the separate Connect version checks to confirm coverage of CVE-2026-48360.

bin/magento --version

How to confirm the fix

• Run the Adobe Commerce/Magento version check again after the update and compare the result with the fixed target for the installed branch. Confirm that the deployed installation reflects the update.
• Verify Adobe Commerce B2B and Adobe Commerce Events separately wherever they are installed. A fixed main Commerce version does not independently confirm the versions of those components.
• Check the installed Adobe Connect version on each affected platform against its own fixed target. If the version information does not clearly establish the installed fix, follow the verification guidance in the vendor's advisory before marking the update complete.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-48356 (added October 27, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 20 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Adobe advisory: https://www.adobe.com/trust/security/products/commerce/apsb26-73.html
• Adobe advisory: https://www.adobe.com/trust/security/products/connect/apsb26-182.html
• NVD: CVE-2026-48356
• NVD: CVE-2026-48360
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.