Vulnerability details
CVE-2026-48358
Adobe CommerceAdobe Commerce B2BAdobe Commerce EventsAdobe Magento Open Source
Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
CVSS 3.1
9.1Critical
Official description
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (adobe) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Adobe | Adobe Commerce | v ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | CVEProject cvelistV5 (CNA) |
| Adobe | Adobe Commerce B2B | v ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | CVEProject cvelistV5 (CNA) |
| Adobe | Adobe Commerce Events | v ≤ 1.20.0 | CVEProject cvelistV5 (CNA) |
| Adobe | Magento Open Source | v ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://helpx.adobe.com/security/products/magento/apsb26-73.html vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-14
- Last updated
- 2026-08-28
- State
- Published
- Assigner (CNA)
- adobe
Exploit prediction (EPSS)
1.2%
Probability of exploitation in 30 days
68.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-116Improper Encoding or Escaping of Output (CWE-116)