Published on 7 August 2026
An attacker needs no login, no administrator rights and no password – just one inattentive second from one of your employees. That's exactly what the most severe of the 14 security vulnerabilities that Adobe patched in Adobe Commerce and Magento Open Source on 14 July 2026 makes possible. Via CVE-2026-48356 (CVSS score 9.6), malicious files – such as a so-called web shell, a small remote-control program for your server – can be uploaded and executed. The result: complete control over your shop, access to customer data and, in the worst case, a payment-data skimmer in the checkout. And the clock is already ticking.
With security bulletin APSB26-73, Adobe fixed a total of 14 vulnerabilities in Adobe Commerce, Adobe Commerce B2B, Magento Open Source and the Adobe Commerce Events SDK. Adobe rates eight of these flaws as critical, four as important and two as moderate. The bulletin carries priority level 2.
You should be aware of the two most dangerous flaws:
Further critical and important flaws affect, among other things, stored cross-site scripting (malicious code that is permanently stored in the backend and executed on the next admin visit, e.g. CVE-2026-47994, CVSS 8.7) as well as faulty authorization checks (CVE-2026-47988, CVSS 8.6 and CVE-2026-47984, CVSS 8.2), which enable unauthorized access to protected resources without a login. Added to this is an SQL injection vulnerability (CVE-2026-47992, CVSS 7.2) as well as several smaller flaws down to an information leak (CVE-2026-48001, CVSS 3.7).
Important for context: at the time of publication, Adobe stated that it was not aware of any active exploitation in the wild. The bulletin reads verbatim:
"Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass." (Adobe Inc., Security Bulletin APSB26-73)
Why is CVE-2026-48356 in particular so dangerous? According to SentinelOne's analysis, the cause lies in a missing or insufficient check during file upload. The application trusts information that the attacker controls themselves – such as the file extension or the so-called Content-Type header (a piece of information stating what kind of file is supposedly being uploaded).
"The root cause is missing or insufficient enforcement of allow-list validation on the file upload handlers. The application relies on client-side checks or trusts attacker-controlled attributes such as filename extensions and Content-Type headers. As a result, files with dangerous server-side interpreted extensions can be stored in web-accessible paths." (SentinelOne Vulnerability Database)
A typical attack chain looks like this:
pub/media/ or pub/static/.The EPSS exploitation probability for CVE-2026-48356 stood at 17.90% in July 2026. As of August 2026, no public exploit code was known – but that can change quickly.
In short: practically every Magento and Adobe Commerce shop that is not on the latest patch level. All active version branches are affected:
According to StoreLeads (as of July 2026), around 104,546 active Magento stores worldwide are affected. In Germany the figure is about 7,022 shops – equivalent to 6.7% of all Magento installations worldwide. This makes Germany the second-largest Magento market in the world after the USA. Particularly at risk are shops without the current patch, shops with the Webhooks feature enabled, shops with outdated third-party extensions and shops without a web application firewall.
A special note for shops on Magento 2.4.6: regular support for this branch ends on 11 August 2026. After that there will be no more security patches.
php bin/magento --version. Compare the result against the affected versions.vendor/bin/patch-status or alternatively with vendor/bin/magento-patches -n status. Check whether the July 2026 patch is shown as "Applied".find pub/media pub/static var -name "*.php" -o -name "*.phtml" -o -name "*.phar". Anything that appears here and does not belong to the core is suspicious.Adobe provides the fixes as so-called isolated patches – as ZIP files, not as Composer packages. Important: each patch applies only to the respective latest patch version of the branch and is not cumulative.
2-4-9-jul-2026.zip for 2.4.9 or 2-4-8-p5-jul-2026.zip for 2.4.8-p5) via the Adobe Experience League article ka-37421. Test first in the staging environment (homepage, cart, checkout, admin), then in production. Adobe Commerce Cloud is updated via the Magento Cloud Patches./admin with a custom one, restrict access via IP allowlisting and enforce two-factor authentication for all admin accounts.core_config_data table for manipulated payment gateway settings.pub/, app/etc/ and var/, monitor login anomalies and subscribe to the Adobe security bulletins. Since 14 July 2026 these have been published twice a month (2nd and 4th Tuesday).Even though no attack is currently known – experience shows that this can change quickly. Simon Bumford, founder of Magento hosting specialist EveryHost, puts it in a nutshell:
"Every Magento security bulletin starts a race. Adobe publishes the fix; attackers download it, diff the patched code against the vulnerable code, and work backwards to an exploit. […] SessionReaper (CVE-2025-54236, patched in September 2025) went from bulletin to mass exploitation in roughly six weeks. […] Patch inside it and APSB26-73 is routine maintenance. Patch after it closes and you are racing automated scanners that already know exactly which endpoints to probe." (Simon Bumford, EveryHost)
The figures back up the pattern: with CosmicSting (CVE-2024-34102, July 2024) more than 4,200 stores were compromised. With SessionReaper (CVE-2025-54236, September 2025) the mass attacks began around six weeks after publication – by the end of October 2025 attackers had infected 16–18% of all Magento stores with backdoors. Security researcher Sansec sums up the situation like this: "Attackers weaponize Adobe security releases within hours of publication." And further: "One in five Magento stores get hacked each year." – Statistically, then, one in five Magento shops is hacked per year.
Dan Garner of AuditIQ poses the crucial question that goes beyond mere patching:
"The question isn't just 'Have I patched?' It's 'Was my store compromised before I patched?' And more urgently: 'Would I know if it had been?'" (Dan Garner, AuditIQ)
For German SMEs, a successful attack is not just an IT problem but a tangible legal risk. If personal data – customer names, addresses, payment data – is grabbed during a compromise, several obligations come into play:
The decisive point: Adobe provides the patches. Anyone who fails to apply them promptly risks being found partly liable, in the event of damage, for a lack of technical and organizational measures. The GDPR Enforcement Tracker already records 3,202 GDPR fine cases with a total volume of EUR 6.31 billion (as of August 2026). Particularly delicate are Magecart attacks: if checkout skimmers are injected via one of the flaws, credit-card data flows in real time to the attackers – a prime example of a reportable data breach with high risk.
APSB26-73 is not a routine update that can be put off until next week. With an unauthenticated exploitable upload flaw (CVSS 9.6) and a remote code execution in the Webhooks component (CVSS 10.0), the most severe vulnerabilities are exactly the kind that attackers have historically exploited en masse within days to weeks. Currently no active exploitation is known – and this is precisely the window you should use.
In concrete terms, this means: check your version and patch level today, apply the appropriate isolated patch, secure your admin access and keep an eye on your file directories. Anyone still running Magento 2.4.6 should have 11 August 2026 firmly marked on the calendar – after that there will be no more security patches for this branch. Adobe itself frames the urgency unmistakably: "Please apply the latest security updates as soon as possible."