Two Adobe events landed on the same day, October 27, 2026:
- CISA added CVE-2026-48356 (Adobe Commerce and Magento Open Source) to the KEV catalog, more than three months after publication, with a deadline of November 10.
- Adobe published bulletin APSB26-162 for Campaign Classic: six CVEs rated between 9.1 and 10.0 by Adobe.
That's Magento's third KEV entry in two months, after CVE-2026-75650 in September and CVE-2026-71362 in late September. Campaign Classic is back too — this time with a maximum score.
Magento: CVE-2026-48356 Added to KEV
| Field | Value |
|---|---|
| CVE | CVE-2026-48356 |
| CVSS 3.1 (NVD and Adobe) | 9.3 (CRITICAL) — AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| Type | Unrestricted upload of file with dangerous type (CWE-434) |
| Adobe bulletin | APSB26-73 |
| NVD status | Analyzed |
| NVD publication | 2026-07-14 |
| Added to CISA KEV | 2026-10-27 |
| CISA deadline | 2026-11-10 |
NVD description (excerpt):
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user […]
It Takes a Click, and It Still Made KEV
Exploitation requires victim interaction (UI:R): the victim has to visit a malicious URL or interact with a compromised page. No authentication is needed (PR:N), and the scope changes (S:C): the impact reaches beyond the vulnerable component.
On a Magento store, the obvious target is a back-office administrator — their session is what grants file uploads and configuration access. That's our inference; NVD doesn't specify the victim's role.
NVD references two write-ups from Sansec, a firm specializing in Magento security, with indicators of compromise. Their titles point to a mass attack wave: exploitation is no longer targeted.
Affected Versions
NVD lists every version and every patch level (-pN) affected, with no open-ended range:
| Product | Branches and last version listed by NVD |
|---|---|
| Adobe Commerce | 2.4.4 → 2.4.4-p18; 2.4.5 → 2.4.5-p17; 2.4.6 → 2.4.6-p15; 2.4.7 → 2.4.7-p10; 2.4.8 → 2.4.8-p5; 2.4.9 |
| Adobe Commerce B2B | 1.3.3 → 1.3.3-p18; 1.3.4 → 1.3.4-p17; 1.4.2 → 1.4.2-p10; 1.5.2 → 1.5.2-p5; 1.5.3 |
| Magento Open Source | 2.4.6 → 2.4.6-p15; 2.4.7 → 2.4.7-p10; 2.4.8 → 2.4.8-p5; 2.4.9 |
| Adobe I/O Events (for Commerce) | 1.6.0 and later, before 1.21.0 |
⚠️ NVD gives no fixed version for Commerce and Magento: the version to install for your branch is in bulletin APSB26-73. Branches older than 2.4.4 aren't in the list — that doesn't make them safe, it means they're no longer maintained.
Campaign Classic: Six Critical CVEs (APSB26-162)
| CVE | Type | CVSS 3.1 (Adobe) | Privileges |
|---|---|---|---|
| CVE-2026-105781 | SQL injection (CWE-89) → code execution | 10.0 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | none |
| CVE-2026-105780 | Incorrect authorization (CWE-863) → code execution | 9.9 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | low |
| CVE-2026-104353 | OS command injection (CWE-78) | 9.9 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | low |
| CVE-2026-104351 | Code injection (CWE-94) | 9.9 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | low |
| CVE-2026-104350 | Reflected XSS (CWE-79) | 9.3 — AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | none, click required |
| CVE-2026-105779 | SQL injection (CWE-89) → security bypass | 9.1 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | low |
All six were published by NVD on October 27 and are Awaiting Analysis: the scores above are Adobe's; NVD hasn't published its own yet.
The Worst of the Batch: CVE-2026-105781
An SQL injection with no authentication and no user interaction, which according to Adobe can lead to code execution. The 10.0 comes from that combination: network-reachable, no prerequisites, full impact, changed scope.
The three 9.9s (CVE-2026-105780, CVE-2026-104353, CVE-2026-104351) also lead to code execution but need a low-privileged account. In a marketing campaign tool, those accounts are plentiful: operators, agencies, contractors.
Affected Versions
NVD has no configuration for these CVEs yet: no versions are listed. Affected versions and the fixed build are in Adobe bulletin APSB26-162. For Adobe-hosted instances, check with Adobe whether the fix has already been applied.
Detection
Magento
- Recent files in web-accessible directories, especially
pub/media/: a PHP file has no business being there - Admin accounts that are recent or unknown
- CMS blocks and configuration changed for no reason (scripts injected into checkout pages)
- The indicators of compromise published by Sansec and cited by NVD
find pub/media -name "*.php*" -newermt "2026-07-01"
bin/magento admin:user:list
Campaign Classic
- Unusual SQL errors in the application server logs
- Unexpected child processes spawned by the Campaign server (a possible sign of command injection)
- Low-privileged operator accounts active outside their usual hours or source addresses
Mitigation
1. Magento: Apply APSB26-73 Before November 10
That's the CISA deadline. If your store runs a branch older than 2.4.4, the update means a branch migration.
2. Magento: Deal With the Compromise Question
A flaw that's been out since July and, per the references, mass-exploited: patching isn't enough. The KEV entry points to directive BOD 26-04, which requires forensic triage. A file that was already dropped stays in place after the update.
3. Campaign Classic: Apply APSB26-162
Start with CVE-2026-105781, exploitable without an account. In the meantime, the instance shouldn't be reachable from the internet beyond what's strictly needed (tracking pages, public forms).
4. Review Campaign Operator Accounts
Four of the six CVEs need a low-privileged account. Remove unused accounts, enforce multi-factor authentication, restrict contractor access.
Why Continuous Monitoring of Your Adobe Estate Matters
Magento has collected three KEV entries in two months, including this one, published in July and overlooked for three months. The day CISA adds it, you need to know right away which stores run which version, and which -pN patch is applied.
With cveo.tech, inventory your Adobe Commerce, Magento and Campaign instances with their exact versions, and get an automatic alert whenever a CVE affecting them is published or enters the CISA KEV catalog.