Magento CVE-2026-48356: a July patch that October is already exploiting

In July Adobe said it was not aware of exploitation of CVE-2026-48356. That was true on the bulletin date and stopped being true by autumn: the bug entered the known-exploited catalog. Shops that skipped the July package are now on that list, not on a "someday on the storefront" list. Adobe scores it 9.6. The class is upload of a dangerous file type. The impact in their table is privilege escalation. Authentication is not required, but user interaction is. That is not "any visitor drops a shell in one request," and it is not a reason to delay the package.

Which build counts as closed

Your line needs the July suffix 2026-jul. Adobe Commerce: 2.4.4-2026-jul through 2.4.9-2026-jul. Magento Open Source: 2.4.6-2026-jul through 2.4.9-2026-jul. Commerce B2B has July builds of its own branch, and the Events module needs 1.21.0. Later Adobe bulletins in August and September do not cancel this bug: if July is not on the server, the October CISA entry is about you. The theme footer does not show the core version.

After the upgrade it is worth looking, with your eyes, at the directories where the shop accepts files from visitors. A patch does not delete what is already there. And do not mix this note up with the PHP bugs: Magento on an old PHP gets both conversations at once.