What is the CVSS score of CVE-2026-48358?

CVE-2026-48358 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Adobe Commerce are affected by CVE-2026-48358?

Adobe Commerce platforms face an unpatched critical vulnerability enabling authenticated attackers with administrative access to execute arbitrary code across the entire e-commerce environment.

How to fix or mitigate CVE-2026-48358?

Within 24 hours, complete an inventory of all Adobe Commerce, Commerce B2B, and Magento Open Source deployments and disable or strictly limit unnecessary administrative accounts. Within 7 days, enforce multi-factor authentication on all administrative accounts, implement network isolation of Commerce admin consoles, and enable enhanced logging on admin access and configuration changes. Within 30 days, subscribe to Adobe security bulletins for patch announcements, establish an expedited patching process for immediate deployment upon vendor release, and evaluate alternative e-commerce platforms if the patch timeline exceeds 90 days.

Adobe Commerce CVE-2026-48358

EUVD-2026-44421 CRITICAL

Improper Encoding or Escaping of Output (CWE-116)

2026-07-14 adobe

GHSA-q829-qfq5-5548

RCE Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

9.1

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

CRITICAL

qualitative

NVD

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

RCE reachable over the network but gated behind an elevated/admin account (PR:H); no user interaction, low complexity, changed scope, and total confidentiality/integrity/availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 19:35 vuln.today

v3 (cvss_changed)

CVSS changed

Jul 29, 2026 - 19:22 NVD

10.0 (CRITICAL) 9.1 (CRITICAL)

Analysis Updated

Jul 15, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 14:22 NVD

9.1 (CRITICAL) 10.0 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 20:53 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

CRITICAL 9.1

DescriptionNVD

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin stems from improper output encoding/escaping (CWE-116) and lets a high-privileged attacker run code in the context of the current user with no user interaction. Because the scope is changed, exploitation can affect components beyond the initially vulnerable one, and Adobe rates it CVSS 9.1. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.90%, 56th percentile), so risk is currently theoretical/targeted rather than mass-exploited.

Technical ContextAI

Adobe Commerce (formerly Magento) is a PHP-based e-commerce platform; Magento Open Source is its free edition, Adobe Commerce B2B adds business-to-business features, and the Webhooks Plugin dispatches event-driven HTTP callbacks. The flaw is classed as CWE-116 (Improper Encoding or Escaping of Output), meaning data is emitted into an output context without proper neutralization, allowing attacker-controlled content to be interpreted as executable instructions rather than inert data. The CPE set (cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, adobe_commerce_webhooks_plugin) confirms the Webhooks Plugin is a distinct affected component, consistent with the webhook/templating pipeline being a plausible sink for unescaped output that reaches a code-execution context.

RemediationAI

Apply the vendor-released patches per Adobe advisory APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html): upgrade Adobe Commerce and Magento Open Source to the 2026-jul patched builds (2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, and for Commerce also 2.4.5-2026-jul and 2.4.4-2026-jul), upgrade Adobe Commerce B2B to the corresponding 2026-jul builds (1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul), and upgrade the Adobe Commerce Webhooks Plugin to 1.21.0. If patching must be delayed, restrict and audit admin/high-privilege accounts since exploitation requires PR:H - enforce MFA on the admin panel, limit which operators can create or modify webhooks, and consider disabling the Webhooks Plugin if it is not in use (trade-off: outbound event integrations relying on it will stop firing). Because the fix references dated patched releases rather than a single tagged number, confirm the exact build for your deployment against APSB26-73.