Adobe Commerce & Magento: 14 Flaws Patched, One Critical (CVSS 9.6)

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/5 · Initial Access

The attacker exploits an unsecured upload endpoint in Adobe Commerce/Magento without needing login or admin rights.

T1190 – Exploit Public-Facing Application
  • CVE-2026-48356 (CVSS 9.6): Unrestricted Upload of File with Dangerous Type
  • No login, no admin rights – only user interaction (crafted URL) required
  • Alternatively CVE-2026-48358 (CVSS 10.0): unauthenticated and no interaction via the Webhooks component
  • Affected: Adobe Commerce 2.4.4–2.4.9, Magento Open Source 2.4.6–2.4.9
PHASE 2/5 · Execution

A PHP web shell is written to a web-accessible directory and called via browser to execute code.

T1505.003 – Server Software Component: Web Shell T1059 – Command and Scripting Interpreter
  • Root cause per SentinelOne: missing allow-list validation, trusting filename extension and Content-Type header
  • File stored in web-accessible paths such as pub/media/ or pub/static/
  • Calling the file in the browser enables Remote Code Execution (RCE)
  • EPSS exploitation probability in July 2026 at 17.90%
PHASE 3/5 · Persistence

The attacker sets up a persistent backdoor to maintain access to the shop server.

T1505.003 – Server Software Component: Web Shell
  • Web shell acts as a small remote-control program for persistent server access
  • Enables later injection of additional malicious code
  • Additional risk via Stored XSS (CVE-2026-47994, CVSS 8.7) in the backend
PHASE 4/5 · Collection

Through server control, customer data and database contents are gathered.

T1005 – Data from Local System
  • Access to the shop's customer data
  • Additional flaw: SQL injection CVE-2026-47992 (CVSS 7.2)
  • Broken authorization checks: CVE-2026-47988 (8.6) and CVE-2026-47984 (8.2) allow access without login
PHASE 5/5 · Exfiltration & Impact

Customer data is exported and a checkout skimmer harvests credit card data during payment.

T1567 – Exfiltration Over Web Service T1565 – Data Manipulation
  • Injection of a payment data skimmer at checkout
  • Credit card data is harvested during payment
  • Full control over the shop; GDPR notification duty (Art. 33) may apply
  • Approx. 104,546 active stores potentially affected worldwide, about 7,022 in Germany
Short & clear answers
Frequently asked questions about this incident
Am I affected by the APSB26-73 security vulnerability?
Practically every Magento and Adobe Commerce store that is not on the latest patch level is affected – specifically Adobe Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9. Check your version in the admin panel under System > Tools > Web Setup Wizard or via command line with php bin/magento --version. According to StoreLeads, around 104,546 stores worldwide are affected, roughly 7,022 of them in Germany.
What do I need to do right now?
Immediately apply the appropriate Isolated Patch for your version branch via the Adobe Experience League article ka-37421, and test in your staging environment first. If you are not on the latest patch version (e.g. 2.4.8-p4), you must first update to it (2.4.8-p5) before the patch can be applied. Additionally, enable a Web Application Firewall and secure your admin access with two-factor authentication.
How can I tell if my store has already been hacked?
Scan web-accessible directories with find pub/media pub/static var -name "*.php" -o -name "*.phtml" -o -name "*.phar" for unfamiliar PHP files that don't belong to the core. Also check your web server logs for POST requests to upload endpoints followed by GET requests to the same paths, and review CMS blocks under Content > Blocks for obfuscated JavaScript snippets. Additionally, look for unknown admin accounts and foreign API integrations.
How dangerous are these vulnerabilities really?
The most severe flaw, CVE-2026-48358, has a CVSS score of 10.0 and allows an unauthenticated attacker to execute arbitrary code on the server without any user interaction – but only stores with the Webhooks feature enabled are affected. CVE-2026-48356 (CVSS 9.6) enables uploading a webshell via a crafted URL. Adobe was not aware of any active exploitation at the time of release, and no public exploit code was available as of August 2026.
What happens to my store if I'm still running Magento 2.4.6?
Regular support for the Magento 2.4.6 branch ends on 11 August 2026. After that date, no further security patches will be released, leaving your store unprotected against future vulnerabilities. You should therefore plan an upgrade to a supported version branch as soon as possible.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.